Skip to main content
This is where the real decision is made. Making AI assistant access available to your tenant exposes nothing on its own — until a group holds one of these permissions, an assistant that connects finds no capabilities at all.

​
Prerequisites

  • AI assistant access is provisioned for your tenant. See Introduction.
  • You hold Manage permissions, which is what the Permissions screen requires to make changes.

​
The permissions

You will find the reading and changing permissions under the MCP Access area on the Permissions screen, the configuration permissions under the MCP Administration area, and all of them in the wider permission catalogue.

​
Reading

​
Changing

​
Configuration

These let an assistant work with configuration through the configuration tools. They are listed under the MCP Administration area — not to be confused with the MCP Administration permission below. Each area has a View permission, which lets the assistant read the area’s configuration — look an item up, find where it is used — list the area’s operations and preview a change, and a Change permission, which lets it propose and apply changes and includes View. MCP: View Configuration Changes admits the configuration audit log and the list of changes the assistant proposed, with what became of each. Grant it together with the area permissions: without it, the assistant cannot learn whether a change it proposed was approved, nor read who changed an item before. None of these work on their own. AI features must be available in your environment, and the person also needs Use AI Admin Assistant, the admin assistant switched on for the environment, and, for each change, the permission its admin page requires. A Change permission lets the assistant propose; whether a change waits for approval is decided by the environment’s levels and the person’s own auto-apply.

​
Everything

MCP Administration has covered the editing permissions and the configuration permissions since they were introduced. A group that held it before then gained them when your environment was updated, without anyone ticking them. Review which groups hold it, and give a group that should only read the read permissions instead.
The read permissions are independent of one another: granting searches does not grant document content. MCP: Edit Keywords and MCP: Edit Caseflow each include their own read permission, because an assistant that may change a value has to be able to see what it changed. MCP: Reindex Documents includes no read permission: pair it with MCP: View Catalog and MCP: View Keywords, so the assistant can check the target document type and see which keyword values are at stake before it reindexes. Grant only what the group’s work actually needs.

​
Granting them

1

Open the Permissions screen

Go to Settings → Access → Permissions and find the user group you want to change.
2

Tick the MCP permissions

For work with documents, start with MCP: View Catalog — an assistant is close to useless without it, and it exposes no customer data. Work that is only in Caseflow does not need it: MCP: View Caseflow lists the applications and classes itself. Add the rest as the group’s work requires, and add the editing permissions only once the group has worked with the reading ones for a while. For configuration work, tick the areas under MCP Administration together with MCP: View Configuration Changes, and make sure the group also holds Use AI Admin Assistant.
3

Save

Changes are staged and take effect when you save, and the change is written to the audit trail like any other permission change.
MCP: View Documents gives an assistant the content of any document the person can already open, MCP: Run Searches returns keyword values on every result row, and MCP: View Caseflow returns the attribute values of every case object a search matches. Treat all three as you would a bulk export permission — the assistant reads at machine speed and the data leaves the product in the conversation.
MCP: Change Access Configuration and MCP: Change Retention Configuration let an assistant propose changes to who can see what and to how long documents are kept. Those changes wait for approval by default, but an environment can allow auto-apply for them. Check the environment’s levels before you grant either.
The three editing permissions let an assistant change customer data on its own initiative. MCP: Reindex Documents is the sharpest of them: reindexing changes what a document is, regenerates its name, and can remove its keyword values — all of them, unless the assistant carries them over — and the document history does not record the values it removed. Grant it to the groups whose job is classifying documents, and not more widely than that.

​
What the permission does not do

A permission never widens what someone can reach. It decides which capabilities their assistants may use; their own document access rights still decide which documents those capabilities return, and the access rights of each Caseflow class which case objects. Two people in the same group, both holding MCP: View Documents, will get different answers from the same question if their document rights differ — exactly as they would in the product.

​
Removing access

Revoke the permission and the capability disappears from the assistant on its next request on most setups — within a few minutes at most. Revoking every MCP permission from a group leaves its members able to connect, but with nothing to call. To cut access for the whole tenant rather than one group, ask for AI assistant access to be switched off; nothing MCP-related is reachable while it is off, regardless of who holds what.

Connecting an assistant

Connect Claude Code, Codex, or the hosted Claude connector to Nobly Insight over MCP, and the connection details worth knowing before you do.

Managing permissions

How staged permission changes, saving, and the audit trail work on the Permissions screen.

Document access rights

The rights that decide which documents a person — and so their assistant — can reach.