> For the complete documentation index, see [llms.txt](https://docs.meetalto.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.meetalto.ai/mcp/permissions.md).

# Manage your assistant's access

Understand permission requests, workspace boundaries and how to disconnect an AI app.

Your MCP connection is tied to the workspace you approve during sign-in. It acts with your current membership and role.

## Approve access for the task

Initial sign-in can request the permissions required by the enabled tools together, including writes, AI generation and publishing. Older connections may have only basic read access. Read the consent screen rather than assuming a new connection is read-only.

Seeing a tool in your AI app does not mean the connection can run it yet. Every action still depends on granted permissions, your current workspace role, the workspace plan and the target account or resource.

If a request needs more access, the app may ask you to approve additional permissions. Read the request and approve only what you want that app to do. Your workspace role and plan still apply after approval.

Some tools always require several permissions. Others need extra access only for particular inputs or saved states: saving an active agent requires `agents:publish`, while an ordinary paused-agent edit does not. The [tool reference](https://docs.meetalto.ai/mcp/reference) distinguishes required, input-dependent and saved-state permissions. Discovery is guidance; the server checks current state again before making the change.

AI agent work uses four permissions: `agents:read` to inspect, `agents:write` to compose or save, `agents:simulate` to test, and `agents:publish` to turn an agent on, make it the main agent, change who agents reply to, or save or delete a live agent. See [prepare and test an agent](https://docs.meetalto.ai/mcp/workflows/agent).

Alerts use `alerts:read` to inspect them and `alerts:write` to save new ones, which are always saved switched off. No permission lets an AI app turn an alert on: a workspace owner does that in Meet Alto. Alerts that send to Slack or watch Shopify purchases also need `integrations:read`, and alerts also read contacts and the inbox. Saving a segment uses `contacts:write`.

After a permission request, keep the original idempotency key and input when retrying the same action. If the result instead says `OPERATION_UNRESOLVED`, pending or uncertain, inspect the operation and resource first. See [safe retries](https://docs.meetalto.ai/api/requests).

If the AI app does not update permissions automatically, open **Manage MCP** in Meet Alto and follow **Reconnect with more access** for your app. Some clients pin their permission list in configuration and need it updated before signing in again.

Declining access is a valid choice. Ask your assistant to stop or choose a task within its existing permissions.

## Understand the three approval layers

| Layer                                 | What it controls                                                             |
| ------------------------------------- | ---------------------------------------------------------------------------- |
| Meet Alto sign-in and permissions     | Which workspace and types of operations the connection can access.           |
| Your AI app's tool approval settings  | Whether the app asks before a particular tool call. Settings vary by client. |
| Your instructions in the conversation | The task, target and changes you want the assistant to make.                 |

“Show me first” and “read only” are useful instructions, but they do not revoke granted write access. Keep tool confirmations enabled when you want to review calls. Meet Alto does not promise a separate browser confirmation for every change: an authorized write can take effect when the assistant calls it.

Read permissions retrieve information. Write permissions can save or delete supported resources. Publish permissions can enable agents or activate automations. Changing an agent's audience requires both `agents:write` and `agents:publish` because it changes who may receive replies. See [actions and their effects](https://docs.meetalto.ai/mcp/actions).

If a client supports choosing a smaller scope list, use the permissions for your intended tasks. If its consent flow cannot grant the access you want, decline it. To reduce an existing grant, disconnect and authorize again with the intended permissions; changing a prompt or hiding a tool alone does not revoke access.

## Understand what the AI app can receive

Tool results may include workspace information, customer conversations, contact details and knowledge content when the connection has the corresponding access. The AI app receives those results, so use an app and account approved for that information.

OAuth sign-in avoids pasting credentials into chat. A client may request `offline_access` to keep working through token refresh until access expires or is revoked. Keep tokens, upload tickets and temporary private download links out of shared conversations and logs.

## Use another workspace

Changing the dashboard's selected workspace does not change an existing connection. Use a separate, clearly named connection for another workspace, or reconnect and select the intended workspace. Confirm the workspace with a read before making changes.

## Disconnect an app

Open **Settings → Integrations → Manage MCP → Your connections**. Find the connection you want to remove, select **Disconnect** and review the workspace in the confirmation.

The list shows connections observed for your user; an older connection may appear only after it makes another authenticated request. Removing an entry in your AI app alone does not prove that its server-side access was revoked.

After disconnecting, the app must obtain new authorization to use Meet Alto again. If a connection is missing or access behaves unexpectedly, [contact support](mailto:hey@meetalto.ai).

## Keep actions deliberate

Ask your assistant to explain the target account, audience and proposed change before enabling or publishing a workflow. If it reports an uncertain result, inspect the current state before repeating the action. [Learn about retries](https://docs.meetalto.ai/api/requests).