> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insight.nobly.dk/llms.txt
> Use this file to discover all available pages before exploring further.

# Granting access

> Decide which AI assistant capabilities each user group may use, and grant them on the Permissions screen.

This is where the real decision is made. Making AI assistant access available to your tenant exposes nothing on its own — until a group holds one of these permissions, an assistant that connects finds no capabilities at all.

## Prerequisites

* AI assistant access is provisioned for your tenant. See [Introduction](/mcp/introduction).
* You hold **Manage permissions**, which is what the [Permissions screen](/permissions/managing-permissions) requires to make changes.

## The permissions

You will find these under the **MCP Access** area on the Permissions screen, and in the wider [permission catalogue](/permissions/application-permissions).

| Permission              | Grants                                                                                                                 |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **MCP: View Catalog**   | Let an assistant list document types and keyword types. Configuration names only — no customer data.                   |
| **MCP: Run Searches**   | Let an assistant run document searches. Results carry keyword values, which for most solutions includes personal data. |
| **MCP: View Documents** | Let an assistant read document metadata, revision history, and document content.                                       |
| **MCP: View Keywords**  | Let an assistant read keyword values on a document, and keyword dataset contents.                                      |
| **MCP Administration**  | Namespace administrator — satisfies all four of the above.                                                             |

Each is independent: granting searches does not grant document content. Grant only what the group's work actually needs.

## Granting them

<Steps>
  <Step title="Open the Permissions screen">
    Go to **Settings → Access → Permissions** and find the user group you want to change.
  </Step>

  <Step title="Tick the capabilities under MCP Access">
    Start with **MCP: View Catalog** — an assistant is close to useless without it, and it exposes no customer data. Add searches, documents, and keywords as the group's work requires.
  </Step>

  <Step title="Save">
    Changes are staged and take effect when you save, and the change is written to the audit trail like any other permission change.
  </Step>
</Steps>

<Warning>
  **MCP: View Documents** gives an assistant the content of any document the person can already open, and **MCP: Run Searches** returns keyword values on every result row. Treat both as you would a bulk export permission — the assistant reads at machine speed and the data leaves the product in the conversation.
</Warning>

## What the permission does not do

A permission never widens what someone can reach. It decides which *capabilities* their assistants may use; their own [document access rights](/configuration/document-access-rights) still decide *which documents* those capabilities return.

Two people in the same group, both holding **MCP: View Documents**, will get different answers from the same question if their document rights differ — exactly as they would in the product.

## Removing access

Revoke the permission and the capability disappears from the assistant on its next request on most setups — within a few minutes at most. Revoking every MCP permission from a group leaves its members able to connect, but with nothing to call.

To cut access for the whole tenant rather than one group, ask for AI assistant access to be switched off; nothing MCP-related is reachable while it is off, regardless of who holds what.

## Where to read next

<Card title="Connecting an assistant" icon="plug" href="/mcp/connecting-an-assistant" horizontal>
  The exact commands for Claude Code, Codex, and the hosted Claude connector.
</Card>

<Card title="Managing permissions" icon="users-gear" href="/permissions/managing-permissions" horizontal>
  How staged permission changes, saving, and the audit trail work on the Permissions screen.
</Card>

<Card title="Document access rights" icon="folder-closed" href="/configuration/document-access-rights" horizontal>
  The rights that decide which documents a person — and so their assistant — can reach.
</Card>