Skip to main content
Your AI tool does not get its own permissions in Condense. It works as you, and Condense narrows what it can do in three places.

​
Three controls, and the narrowest wins

  • What you approve. You set it on the approval page, and later on the AI Tools page.
  • What your administrator allows. An Organization Admin sets it in AI Governance, for each environment.
  • What your Condense role allows. Your administrators set it through your roles in the environment and the workspace.
Approving a connection never gives you anything new. If you cannot do something in Condense yourself, your AI tool cannot do it for you. If your AI tool cannot read something you expect, the fix is a role from your administrator.

​
Operating modes

An Organization Admin chooses an operating mode for each environment in AI Governance.
  • Strict read-only. AI tools can only read data. Any action that modifies state is blocked, regardless of a member’s Condense permissions. For example, a member who can deploy connectors in Condense cannot deploy one through an AI tool in this environment.
  • Adaptive, follow each member’s role. AI tools inherit each member’s Condense permissions, allowing only actions the signed-in member is already authorized to perform. For example, a member who can deploy in a workspace can deploy through their AI tool. A member who cannot, cannot.
In a read-only environment, the approval page lists the tools with no checkboxes, because there is no choice left to make.

​
What you can configure

  • Environment. The one environment a connection reads. You set it on the approval page.
  • Permissions. Which tools an AI tool may use. You set them on the approval page, then with Edit Permissions on the AI Tools page.
  • Operating mode. Whether changes are blocked in an environment. An Organization Admin sets it in AI Governance.
  • Allowed tools. Which tool groups and tools AI tools may use in an environment. An Organization Admin sets them in AI Governance.
  • Pause, resume, disconnect. Whether a tool or a member’s connection works. You decide for your own tools on the AI Tools page. Administrators decide for any tool or member in AI Access Management.

​
Which roles can do what

Condense roles are described in Access Control List. Condense MCP does not add roles of its own.
  • To read pipelines, connectors, configurations and logs, you need access to the environment and the workspace.
  • To deploy a connector, you need a role that lets you deploy in that workspace.
  • To open AI Governance, you need an Organization Admin account that has AI Governance access.
  • To open AI Access Management, you need an Organization Admin account that has access to it.

​
When something is refused

If a tool is switched off for your account or role, your AI tool reports Access denied. Ask your Condense administrator to enable it. See Errors and troubleshooting.