Agents and access

Every client that connects to your MCP address is an agent: one piece of software that one person lets act for them, such as “Claude Code on my laptop” or “Codex in CI”. In the console, agents are called connections and connectors are called apps.

An agent never gets more than its person

What an agent may do with a tool depends on two things:

1. The person’s permission on that app. An admin decides who may use an app, and whether agents may only look things up or also make changes.
2. The agent’s own access. A person can give Codex read only, although they may write themselves.

Tools an agent may not use are not listed. If it calls one anyway, it gets a short sentence saying it was denied and why.

Levels

When a person creates a connection, they pick a level per app, or one level for every app:

Level	Reads	Changes and deletes
Look things up	yes	no
Look things up, ask before changes	yes	after the person approves
Do everything without asking	yes	yes
Off	no	no

You can add exceptions for single tools: block one tool, or let one tool run without asking. “All apps” includes apps that are added later.

Asking first

When a rule says ask first, the call waits until the person approves it in the console, under Approvals. Only a person can approve, never the agent.

While it waits, the agent gets a message with a link to show the person, for example:

Waiting for Alice to approve this action. Nothing was sent.
Show them this link now, they approve or decline it in Flowplane: https://console.flowplane.eu/approvals?id=…

Once it is approved, the agent calls the same tool again with exactly the same arguments, and the call runs.

Signing in to apps

Some apps sign in per person, others with one login for the whole workspace. When a call cannot go out because nobody signed in yet, or a login expired, the agent gets one sentence saying who has to sign in, and where.