---
title: "Safety and permissions"
description: "What an agent can change, what only the owner should decide, and how to bound it."
canonical: "https://atelier201.com/docs/mcp/safety-and-permissions"
updated: "2026-11-06"
---

# Safety and permissions

Three controls, applied in this order. The effective permission of any request is
their intersection.

**1. The scopes on the credential.** Chosen when the connection is approved. The
consent screen describes each one in a sentence, and that sentence is the
contract: a capability that was not described when consent was given is never
added to an existing scope later.

**2. The workspace's member ceiling.** The most a non-admin member may delegate.
Set by admins in **Developer tools → Permissions**. It applies to OAuth
connections, which carry a person's identity, not to API keys, which are
workspace service credentials with no person attached.

**3. That person's own override**, if an admin set one for them.

> **Warning: sites:publish is its own scope for a reason**
>
> Publishing puts a site on the internet. It is deliberately separate from
> `sites:write`, so an agent allowed to build and edit a site is not thereby
> allowed to show it to the world. If you are unsure, grant `sites:write` and
> withhold `sites:publish` and `domains:write`: the agent prepares everything and
> you publish.

## What stays with the owner

An agent should never publish a site, connect a domain or change a plan without
the owner's explicit instruction. The owner's claim click on a prepared site and
the OAuth consent are not that instruction. A preview link shows exactly what
would go live, so share one first.

Publishing is also pinned to what was reviewed: `publish_site` takes the
`expected_generation` that `review_publish` returned and is refused if anything
changed since.

## Revoking

Any connection can be revoked instantly from **Developer tools → Connections**.
Removing someone from the workspace revokes everything they delegated from it,
automatically.