User → agent MCP access

Agents reach external tools through the MCP gateway. This page covers per-agent connector and tool permissions — what an agent may do once running, independent of who can chat with it.

Two layers, checked in order

Reachability — can the calling user reach the connector at all? They can if they own it, it’s shared with them (by username — team/department sharing is nasiko-ee only, see below), or it’s a platform-managed integration they’ve connected their own account to. A connector that fails this check is invisible — it doesn’t appear in the tool list.
Per-agent permission — is the connector enabled for this agent, and is the specific tool allowed?

Layer 2 is only consulted if Layer 1 passed. Reachability is re-evaluated on every call, never cached past a permission change.

No configuration means fully allowed

Per-agent permission is default-allow. Sharing a connector with someone makes it usable on every agent they run, immediately. A permission row exists only to restrict: disable a connector for one agent, or apply a rule to its tools.

Stance	Effect
`allow`	Callable normally (the default)
`ask`	Blocked and reported as requiring approval
`block`	Rejected outright

Rules are glob patterns against tool names:

{
  "enabled": true,
  "tool_rules": [
    { "pattern": "SEND_*", "stance": "block" },
    { "pattern": "READ_*", "stance": "allow" },
    { "pattern": "DELETE_*", "stance": "ask" }
  ]
}

The connector stays enabled, but every SEND_ tool is blocked, reads are allowed, and deletes need approval.

Configuring it

Action	Route
View an agent’s connector access	`GET /api/mcp/agents/{agent_id}/connectors`
Set one connector’s rules for one agent	`PUT /api/mcp/agents/{agent_id}/connectors/{connector_id}`
Inspect a connector’s tools and effective stances	`GET /api/mcp/agents/{agent_id}/connectors/{connector_id}/tools`
View or bulk-update every tool rule	`GET` / `PUT /api/mcp/agents/{agent_id}/tools`
Reset to default-allow	`DELETE /api/mcp/agents/{agent_id}/permissions`

Example body for the PUT:

{
  "enabled": true,
  "tool_rules": [
    { "pattern": "SEND_*", "stance": "block" }
  ]
}

Configuring requires the ability to manage the agent (owner or superuser), or reachability to a connector already attached to it. The narrower path lets someone with a shared connector adjust it without gaining other control over the agent.

Enterprise feature. Team/department connector sharing (this whole section) is nasiko-ee only. The open-source edition’s connector sharing (see MCP connector-sharing routes) covers public, per-user, and per-agent shares — no teams or departments.

Owners share by username through the MCP connector-sharing routes. Team and department sharing is an admin operation:

nasiko-ee access mcp share <connector-id> --team platform-eng --dept engineering
nasiko-ee access mcp unshare <connector-id> --team platform-eng
nasiko-ee access mcp consumers <connector-id>   # agents, users, teams using it

Revoking a share also deletes the grantee’s stored credential for that connector. A later re-grant starts from a clean reconnect.

MCP overview — connectors, connections, request flow
User → agent access
Access control overview

Getting Started

CLI

ADLC

Dashboard

Platform

MCP Gateway

MCP Hub

Agents in Artifact Registry

Two layers, checked in order

No configuration means fully allowed

Configuring it

​Two layers, checked in order

​No configuration means fully allowed

​Configuring it

​Sharing a connector with a team or department

​Related

Two layers, checked in order

No configuration means fully allowed

Configuring it

Sharing a connector with a team or department

Related