Integrations
Connected tools and approvals
Configure an MCP connection, workflow and agent access, per-tool policies, and one-time approvals.
Connected tools and approvals
Configure an MCP connection, workflow and agent access, per-tool policies, and one-time approvals.
Where to find it
Open Account > Assistant > Developer Access > Connected tools.
Choose the connection and identity
Open Account > Assistant > Developer Access and find Connected tools. Review the server and whether its provider authentication is per-person or shared before connecting or changing access. A successful connection check is readiness evidence, not permission for every tool to run.
Review Tool access
For every discovered tool, inspect its purpose, choose its Risk, then set Execution access:
| Execution access | Behavior |
|---|---|
| Blocked | The tool cannot be called through this connection's policy. |
| Ask for approval each time | A call needs its specific approval before execution. |
| Allow autonomously | Eligible workflows may execute it without a per-call approval. |
Risk choices are Reads data, Changes data, and Deletes or irreversible. A server's read-only claim is a hint to review, not proof of harmless behavior. Classify all tools, choose Save reviewed access, and recheck the saved access. Changed manifests can require a new review.
Set workflow and agent access
Use Chat workflows and Coding workflows to select where the connection is available, then Save workflow access. Review selected agent attachments separately; permitting a workflow does not make every agent eligible. Turning a workflow off blocks new calls and invalidates coding grants. Review the current agent selection after changing it.
For service-account connections, changing requested scopes revokes the current token. Choose Save service account access and check the connection again before relying on it.
Respond to one-time approvals
Review the requested tool and action, then choose Approve once or Deny. Approval is single-use and expires after five minutes; it does not change the persistent execution policy. An expired request needs a fresh request, not a switch to autonomous access.