Skip to content
Help Center
Start 10-day free trialStart 10-day free trialStart 7-day free trialStart 10-day free trialStart 10-day free trialStart 10-day free trialStart 10-day free trialStart 10-day free trialStart free

Limit and revoke a connected assistant

Every connected assistant acts as one person in one workspace. This page covers how to see them, narrow them and stop them.

See what is connected

Section titled “See what is connected”

Administrators open Settings → MCP access. The list shows each token’s name, owner, when it was last used, when it expires and its status (Active, Expired or Revoked). Never used is worth a look: a token nobody uses is one to revoke. Show revoked lists the ended ones.

Decide whether it may apply changes on its own

Section titled “Decide whether it may apply changes on its own”

When you issue a token, Final changes is off by default. That means the assistant proposes and you approve:

  • A change covered by an approval policy waits in the approvals queue.
  • The assistant can’t approve or reject an approval request, including its own.

If you tick This agent may change things without approval, it writes directly and can decide approval requests, but never with more rights than its owner has. Tick it only for an assistant you trust with that, and say so to whoever owns the token.

The setting can only narrow access. A token never gets rights its owner doesn’t have.

Reduce what it can reach

Section titled “Reduce what it can reach”

A token carries its owner’s permissions. Change the owner’s roles and the token’s reach changes at once. Remove someone from the workspace and their tokens stop working on the next call, without anyone revoking them.

Revoke a token

Section titled “Revoke a token”
  1. Open Settings → MCP access.
  2. Click Revoke on the token and confirm.

The token stops working on its next call. Revoking can’t be undone: the token stays on the list so the record shows what it did, but it can never be switched back on. Issue a new one instead. A revoked token can be deleted from the list, which also removes the record of when it was used from this screen; the changes it made stay in the change journal.

Who can do what

Section titled “Who can do what”
  • A person whose role allows it can connect an assistant of their own.
  • Settings → MCP access and revoking anyone’s token belong to administrators and general managers.
  • Every change an assistant makes is recorded under the owner’s name, with the token that made it.
Section titled “Related”