# What an agent may do (/docs/agents/permissions)

An agent has no role of its own. Every call it makes runs as the person who connected it, at that moment: with their [role](/docs/organizations/roles) in the Organization and Space, the [products and Spaces](/docs/organizations/product-access) they may use, and the Organization's products switched on. Change someone's role, or take a product away, and their agents can do less with the next call.

On top of that comes the scope the agent was given: with `obelism:read` it only gets the tools that read, whatever the role.

## Per role [#per-role]

With `obelism:write`:

| An agent may…                                                                                   | Admin | Developer | Editor | Reader |
| ----------------------------------------------------------------------------------------------- | :---: | :-------: | :----: | :----: |
| Read tests, flags and results, entries and assets, reports and events, members and Spaces       |   ✓   |     ✓     |   ✓    |   ✓    |
| Comment on Content's entries                                                                    |   ✓   |     ✓     |   ✓    |   ✓    |
| Create, change, start and delete Improve's tests, flags and audiences                           |   ✓   |     ✓     |   ✓    |        |
| Create, save, publish, schedule and translate Content's entries; upload assets; import a design |   ✓   |     ✓     |   ✓    |        |
| Change Content's model; create and rename Spaces                                                |   ✓   |     ✓     |        |        |
| API tokens and webhooks; allowed origins; connected deployments                                 |   ✓   |     ✓     |        |        |
| Invite, change and remove members; roles per Space; transfer a Space                            |   ✓   |           |        |        |
| Delete an Organization or a Space                                                               |       |           |        |        |

Where Content's publishing is **reviewed**, only an admin's agent publishes, unpublishes or schedules there; anyone else's is refused with `review_required`.

## Production [#production]

- **Content** refuses agents in `production` what would connect a site: creating or revoking API tokens, creating, changing or deleting webhooks and rotating their secrets, and changing the Space's settings (the preview URL and prompt endpoint). The answer is `403 production_protected`; a person does it in Content's dashboard. Agents do all of it in `develop` and `staging`, and read everything in production.
- **Allowed origins**: an agent can't allow any origin in `production`. A person does that on the Space's page.
- Everything else follows the role, in every environment alike. To keep production publishing to admins, turn on Content's reviewed publishing there.

## What no agent is offered [#what-no-agent-is-offered]

- Deleting an Organization or a Space, signing out, and changing the password: the MCP server doesn't have those tools.
- Anything the person can't do in the dashboard.

## The ⌘K prompt [#the-k-prompt]

⌘K in the dashboards is stricter than an MCP client:

|                                   | MCP server                              | ⌘K                                          |
| --------------------------------- | --------------------------------------- | ------------------------------------------- |
| Reaches                           | Every Organization and Space you're in  | The Space and environment you're looking at |
| Changes                           | Without asking, unless your client asks | Only after you confirm each one             |
| Token values and webhook secrets  | Returned once, where your role allows   | Never shown                                 |
| Members, Spaces, the Organization | Yes, where your role allows             | Never                                       |
| Products                          | Improve, Content, Numbers               | Improve, Content, Numbers                   |

## Keeping an agent in check [#keeping-an-agent-in-check]

- **Connect it with read only** when it only needs to look: the consent page shows which scope the app asked for, so ask for read in your client's settings where it offers that.
- **Use a member with a smaller role**: an agent for writing copy can run as an editor who is kept out of Improve.
- **Ask it to check with you** before it changes anything, and use a client that confirms tool calls marked destructive.
- **Disconnect it** on [Agents](https://www.obelism.studio/agents) when you're done. Access ends by itself after 30 days without use.