Managing tool access

Tool access controls which Connector tools each employee can call from their AI client. It is part of the Agent Handler for Employees setup: once your directory is connected through SCIM, you set a baseline for everyone, add access for specific groups, and override individual people when you need to. Everything on this page lives under Provisioning → Manage access in the dashboard.

Granting access does not connect anything on its own. Each employee still authenticates every Connector (through Link or OAuth) before its tools work. Access decides what they may reach; authentication decides whether the connection exists.

What tool access does not control

Dashboard role is what someone can do inside the Agent Handler dashboard (Admin, Developer, Security, Read-only). It is set on the same pages but resolves on its own: an Admin can have no tool access and a Read-only user can have every tool. See Team and roles.
Tool Packs decide what an agent can call through a Tool Pack MCP URL: every tool in the pack, for any Connector the Registered User has authenticated. Tool access only applies when an employee signs in as themselves, through the employee MCP URL or the Merge CLI.

How access adds up

Tool access is additive. An employee’s effective access is the union of four tiers, and the most permissive setting wins. A tier set to No tools contributes nothing; it never removes what another tier granted.

Tier	Who it covers	Where you set it	Use it for
Default access	Every provisioned employee	Manage access → Default access	The floor everyone gets
Group access	Members of an IdP group	Manage access → Group access	A job function’s tools, once per group
Per-user override	One person	The user’s page under Manage access	Exceptions a group should not carry
Access requests	One person, one tool at a time	Manage access → Requests	Grants on demand, optionally with an expiry

Every tier picks from the same modes:

Mode	What it grants
All current and future tools	Every tool in the org, including ones added later
Choose tools	Specific Tool Packs and individual tools
No tools	Nothing from this tier
Inherit (groups and users only)	Whatever the tiers above already decided
By request only (users only)	Nothing by default; the user requests individual tools

To give someone no tools at all, the default and every group they belong to must withhold them, and you grant exceptions through access requests.

Access requests

When an employee’s AI client tries a tool they do not have, they can request it with a reason. Requests let you run a tight default and grant the long tail on demand instead of provisioning everything up front.

Employee requests a tool

The request carries the tool, the requester, and their reason. It lands in Provisioning → Manage access → Requests.

You review the queue

Pending requests sit at the top, oldest first, so the request that has waited longest is the first thing you see. Grants still in force come next, then everything closed out. Search covers the requester, their reason, the reviewer’s note, the tool slugs, and the Connector’s display name.

Approve, deny, or revoke

Approve permanently or with an expiry. The tools join the user’s effective access.
Deny with an optional note.
Revoke a grant later if the need passes.

Expiry runs its course

An approval with an expiry becomes its own state once the date passes. An expired grant stops granting access and stops counting as approved, so the approved list holds only grants still in force, and lapsed ones can be listed on their own when you want to see what to renew.

Every approval, denial, and revocation is recorded in the Audit Trail, alongside the reason the employee gave.

Next steps

Tool Packs

Build the bundles you attach in Choose tools

SCIM provisioning

Sync the groups that group access is built on

Team and roles

What each dashboard role can do