What a connection can do
The limits on a connected assistant, how they follow your role, and how to disconnect it.
A connected assistant is not you with a different keyboard. It holds a narrower grant than your account.
The cap
A connection is capped to the permission set of the MCP tool catalog, the permissions the tools in the tool reference need. It is never your full account access, and never anything that belongs to platform administration.
Within that cap, the assistant can do only what your role in the organization lets you do. For what each role holds, see Roles and permissions.
When your role changes
If your role changes, for example a demotion, or you lose a permission a tool needs, every connection you have into the organization narrows to match on its very next request. Nobody has to revoke anything. If you are removed from the organization, every connection you had into it is disconnected.
A connection also carries the permissions it was granted on the day you approved it. Refreshing it renews that same set, so a tool that needs a permission your connection was not granted is refused until you disconnect and connect again; see Troubleshooting.
See and disconnect connections
- Yours. The Connected apps tab of your account settings lists every application you approved in this organization, including assistants connected over MCP. Open Connection actions on its row and choose Disconnect to cut one off. Other members who connected the same application keep their own access. See Account.
- Everyone's. Owners can see every member's connections, and disconnect an application for all of them, under Connected apps in organization settings. See Connected apps.
- All MCP access. An owner or admin who turns off the organization's MCP switch refuses every MCP call at once; see MCP.