> This page is for Agent Handler.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Managing tool access

> How tool access resolves across default, group, and per-user settings in the Agent Handler for Employees setup, plus how access requests grant exceptions.

Tool access controls which Connector tools each employee can call from their AI client. It is part of the [Agent Handler for Employees](/merge-agent-handler/setup/agent-handler-for-employees) setup: once your directory is connected through [SCIM](/merge-agent-handler/administer/scim-provisioning), you set a baseline for everyone, add access for specific groups, and override individual people when you need to. Everything on this page lives under **Provisioning → Manage access** in the [dashboard](https://ah.merge.dev/provisioning/manage-access).

Granting access does not connect anything on its own. Each employee still authenticates every Connector (through Link or OAuth) before its tools work. Access decides what they may reach; authentication decides whether the connection exists.

> **What tool access does not control**
>
> * **Dashboard role** is what someone can do inside the Agent Handler dashboard (Admin, Developer, Security, Read-only). It is set on the same pages but resolves on its own: an Admin can have no tool access and a Read-only user can have every tool. See [Team and roles](/merge-agent-handler/administer/team-and-roles).
> * **Tool Packs** decide what an agent can call through a [Tool Pack MCP URL](/merge-agent-handler/build/tools/tool-packs): every tool in the pack, for any Connector the Registered User has authenticated. Tool access only applies when an employee signs in as themselves, through the [employee MCP URL](/merge-agent-handler/setup/agent-handler-for-employees) or the [Merge CLI](/merge-agent-handler/build/connecting-agents/merge-cli).

## How access adds up

Tool access is additive. An employee's effective access is the union of four tiers, and the most permissive setting wins. A tier set to **No tools** contributes nothing; it never removes what another tier granted.

| Tier                  | Who it covers                  | Where you set it                    | Use it for                                  |
| --------------------- | ------------------------------ | ----------------------------------- | ------------------------------------------- |
| **Default access**    | Every provisioned employee     | Manage access → Default access      | The floor everyone gets                     |
| **Group access**      | Members of an IdP group        | Manage access → Group access        | A job function's tools, once per group      |
| **Per-user override** | One person                     | The user's page under Manage access | Exceptions a group should not carry         |
| **Access requests**   | One person, one tool at a time | Manage access → Requests            | Grants on demand, optionally with an expiry |

\


Every tier picks from the same modes:

| Mode                                | What it grants                                                                          |
| ----------------------------------- | --------------------------------------------------------------------------------------- |
| **All current and future tools**    | Every tool in the org, including ones added later                                       |
| **Choose tools**                    | Specific [Tool Packs](/merge-agent-handler/build/tools/tool-packs) and individual tools |
| **No tools**                        | Nothing from this tier                                                                  |
| **Inherit** (groups and users only) | Whatever the tiers above already decided                                                |
| **By request only** (users only)    | Nothing by default; the user requests individual tools                                  |

To give someone no tools at all, the default and every group they belong to must withhold them, and you grant exceptions through access requests.

## Access requests

When an employee's AI client tries a tool they do not have, they can request it with a reason. Requests let you run a tight default and grant the long tail on demand instead of provisioning everything up front.

#### Employee requests a tool

The request carries the tool, the requester, and their reason. It lands in **Provisioning → Manage access → Requests**.

#### You review the queue

Pending requests sit at the top, oldest first, so the request that has waited longest is the first thing you see. Grants still in force come next, then everything closed out. Search covers the requester, their reason, the reviewer's note, the tool slugs, and the Connector's display name.

#### Approve, deny, or revoke

* **Approve** permanently or with an expiry. The tools join the user's effective access.
* **Deny** with an optional note.
* **Revoke** a grant later if the need passes.

#### Expiry runs its course

An approval with an expiry becomes its own state once the date passes. An expired grant stops granting access and stops counting as approved, so the approved list holds only grants still in force, and lapsed ones can be listed on their own when you want to see what to renew.

Every approval, denial, and revocation is recorded in the [Audit Trail](/merge-agent-handler/observe/audit-trail), alongside the reason the employee gave.

## Next steps

#### [Tool Packs](/merge-agent-handler/build/tools/tool-packs)

Build the bundles you attach in Choose tools

#### [SCIM provisioning](/merge-agent-handler/administer/scim-provisioning)

Sync the groups that group access is built on

#### [Team and roles](/merge-agent-handler/administer/team-and-roles)

What each dashboard role can do