Permissions and Presets

Delegate a Task, Not the Whole Account

Keys belong to one workspace and the owner who created them. Expiration, revocation, owner removal, scope checks, and workspace record validation are enforced server-side. Keys cannot administer themselves or other users. Never share one key broadly when distinct limited keys are possible.

Choose a Starting Preset

Presets are editable scope selections, not role overrides. The current generated reference lists their exact scopes. Removing a permission removes dependent tools from discovery; it does not grant an alternate route to the same action.

• Read-only analyst: inventory, receipts, and reports, with no writes.
• Receipt clerk: product/supplier lookup, receipt processing, and purchase receiving.
• Operations assistant: stock movement/pricing, machine configuration/placement, contact updates, reporting, and audit reads. No finance or deletion by default.
• Bookkeeper: reporting, receipt metadata, mileage, audit reads, and explicit financial configuration. Review its scopes before issuing it.
• Sales importer: product/machine lookup, sales reads and writes, and reports, for turning vendor sales reports into recorded sales.

Important Permission Boundaries

Tools with nested actions may require additional scopes: receipt purchase items require inventory:receive, and embedded new products require products:write. Static discovery scopes are a minimum, not permission to perform every possible nested input.

• inventory:receive creates purchase lots/units. inventory:move relocates existing stock. inventory:price changes existing unit list prices.
• machines:write changes configuration/targets. machines:place handles reviewed relocation.
• locations:write edits contact details. finance:configure changes commission/card-fee settings and is also required when creating a location with commission fields.
• receipts:delete is separate from receipt processing and preserves linked inventory.
• sales:write previews, applies, and undoes sales imports, matches sales to stock, and manages vendor mappings. sales:read lists imports, recorded sales, mappings, and the workspace sales settings.
• audit:read and reports:read reveal operational records/calculations but cannot change them.

Edit an Existing Key

Only workspace owners can edit permissions. The secret, name, expiry, and activity history do not change. Newly authenticated requests use the saved scopes; already-running requests may finish. Expired/revoked keys cannot be edited or reactivated. A stale editor is rejected so two owners cannot silently overwrite each other's permission changes.

1. In Settings > Agent Access, select the pencil action on an active key.
2. Review its permissions, choose a preset or adjust checkboxes, and select Save permissions. At least one current permission is required.
3. Keep the same secret configured in the agent. Refresh/reconnect the MCP client to update its displayed tools.

Existing Keys and Contract Changes

Existing keys never gain new scopes automatically. The pre-v1 inventory:write scope was retired without an alias; edit an active key and explicitly select inventory:receive when needed. Product updates require expectedUpdatedAt, and existing-unit pricing requires preview/apply. Refresh client schemas after deployment rather than relying on cached arguments.