Skip to main content
Private Beta — Contact us to get set up.
Access control determines which tools are available to which users in which contexts. Three layers filter every request before it even reaches content inspection.

​
Connector registry

The connector registry controls which tool sources exist for your organization. An admin enables connectors—internal MCP servers, external services, browser extension tools—and they become available to users. This is org-level configuration. You decide once which connectors are allowed, and that decision propagates everywhere. Want to add a new internal API? Register it. Want to block an external service? Remove it. For external connectors (third-party MCP servers), you can require admin approval before users connect. This prevents shadow IT—users can’t just wire up arbitrary external services without visibility. Version pinning locks connectors to specific versions, preventing unexpected changes from upstream.

​
Role entitlements

Roles come from your IDP. When a user authenticates, their token includes role claims—engineering, support, finance, whatever your organization uses. Role entitlements map these roles to connector access:
RoleGets access to
engineeringInternal APIs, GitHub, Jira
supportCRM, Help Desk
financeBilling, Invoicing
A user only sees tools from connectors their role permits. An engineer won’t see finance tools; a support agent won’t see internal APIs (unless their role includes both).

​
App/origin constraints

Even with the right role, tools can be restricted by where they’re invoked from. Domain allowlists limit which origins can use which tools. CRM tools might only work from crm.example.com. Production database tools might be blocked from staging environments entirely. This prevents tools from escaping their intended context. A user might have access to sensitive tools, but only when they’re in the right application.

​
How they combine

All three checks must pass. A user with the right role still can’t use a tool if the connector isn’t enabled or they’re accessing from a disallowed origin.