Agents get the same permissions as people
Each of the 35 MCP tools is scoped to what the calling user may already do.
Context
LLM agents need to act inside the product: manage assets, edit metadata and publish.
An agent that can do more than the person it works for would be a way around every permission the product has.
Options considered
| Option | For | Against |
|---|---|---|
| A service account with broad rights (rejected) | Simple to build. | An agent could do things its user cannot, and it is hard to audit who did what. |
| A fixed, read-only toolset (rejected) | Safe by construction. | Too limited to be useful for editing or publishing. |
| Tools scoped to the calling user's permissions (chosen) | An agent can never do more than the person it acts for. | Every tool has to check permissions on every call. |
Decision
The MCP server exposes 35 tools, and each one is scoped to the permissions of the user it acts for.
Consequences
Better
- It is live at 4 customers.
- Existing permissions keep their meaning, so there is nothing new to reason about per agent.
Harder
- Every new tool needs its permissions mapped before it can ship.
- Behaviour differs per user, so tests have to cover several roles.