# Permissions and security

A connected assistant never gets more access than you have yourself. Its reach
is bounded three ways: by the **access bundle** you approved when connecting,
by **your role** in the organization, and by an **org-wide switch** your admin
controls.

## What you approve when connecting

When you connect with OAuth, the consent screen asks for two permission
bundles, always together:

- **Read** — let your AI assistant view your scheduling data (event types,
  availability, bookings, meetings, contacts).
- **Write** — let your AI assistant manage your scheduling (create and modify
  bookings, availability, scheduling links, and polls).

OAuth grants are all-or-nothing: there is no read-only OAuth option. If you
want an assistant that can look but not touch, connect with a
[personal access token](/help/ai-assistants/connecting-your-assistant#two-ways-to-sign-in)
instead — when [minting the key](/360/api?tab=apiKeys), pick only `:read`
scopes. (Minting PATs requires the Owner or Admin role, so this option is for
admins; members connect with OAuth.) The assistant then only sees the reading tools; everything else is
hidden from it. The full scope list is in the
[API scopes reference](/help/api/scopes).

## What the assistant sees: your role

The assistant acts as you, with your real dashboard role — not a flattened
"API user":

| Your role | Assistant can read | Assistant can change |
|---|---|---|
| Member | Your own scheduling data | Your own bookings, availability, links, and polls |
| [Manager](/help/team-and-admin/manager-role) | Your group's members, including their bookings and meetings | Yourself and the regular members you manage |
| Admin / Owner | The whole organization | The whole organization |

One deliberate exception: **booking a meeting**. Anyone can ask their
assistant to book on any active event type in the organization — exactly what
they could do through that person's public booking page. The flip side: a
booking made that way on a colleague's event type can't later be canceled or
rescheduled through your assistant, just as it couldn't from your dashboard.

<Callout type="note">
If the assistant asks for something outside your reach — say, a regular member
asks about a colleague's bookings — the data simply isn't returned. Out-of-reach
items behave as if they don't exist.
</Callout>

## Turning MCP off for your organization

Admins decide whether the organization allows AI assistants at all. In
[Admin Center → Permissions](/360/admin?tab=permissions), the **AI assistants**
card has one switch: **Allow AI assistants (MCP)**.

- Turning it **off** immediately blocks every MCP connection in the
  organization — existing ones stop working mid-conversation, and new ones
  can't be authorized.
- Turning it back **on** restores existing connections; nobody has to
  reconnect.

<Screenshot
  src="/help/screenshots/team-and-admin/permissions.png"
  alt="The Permissions tab of the Admin Center, with the AI assistants card at the bottom containing the Allow AI assistants (MCP) checkbox"
  caption="Admin Center → Permissions — the AI assistants card at the bottom holds the org-wide Allow AI assistants (MCP) switch."
/>

Members see a banner on the [AI assistants (MCP)](/360/integrations/mcp) page
explaining why access is unavailable — whether it was disabled by your admin
or isn't enabled on the server yet (the feature can be rolled out gradually).

## Disconnecting an assistant

- **Connected via OAuth:** open
  [AI assistants (MCP)](/360/integrations/mcp), find the assistant in the
  connected list, and click **Disconnect**. It loses access immediately.
- **Connected via personal access token:** delete (or regenerate) the key
  under [Admin Center → API → API keys](/360/api?tab=apiKeys).

You can also remove the connector on the assistant's side, but revoking from
42min is the guaranteed cut-off.

## Safety measures built in

- **Consent, always.** No assistant can touch your account without you
  approving it on a 42min consent screen (OAuth) or minting a key (PAT).
- **Every action is attributed.** Tool calls run under your identity and are
  logged, like your dashboard activity.
- **No secrets in responses.** Tool results never include credentials or the
  private reschedule/cancel/voting tokens embedded in attendee links.
- **Attendee input is treated as data.** Text your invitees typed into booking
  forms is passed to the assistant clearly marked as attendee-provided data,
  not as instructions — a guard against prompt-injection tricks hidden in
  form answers.
- **Same rate limits as the API.** Assistant traffic counts against the usual
  [API rate limits](/help/api/rate-limits), so a runaway loop can't hammer
  your account.

## Common pitfalls

- **Disconnected in the assistant, still listed in 42min.** Removing the
  connector in Claude or ChatGPT doesn't always revoke the grant on 42min's
  side. Check the connected list on
  [AI assistants (MCP)](/360/integrations/mcp) and disconnect there too.
- **A shared PAT is a shared account.** Anyone holding a key acts as the key's
  owner. Don't paste PATs into shared configs; each person should connect
  their own assistant.
- **Admin toggle ≠ per-user control.** The org switch is all-or-nothing for
  the whole organization; there is currently no per-user or per-group
  allowlist.