Limit what an agent can do

When you connect an AI app, you decide how much it may do. Narrow access is the safe default for an agent you don't watch closely.

On the approval screen

When the app connects, the approval screen lets you:

• allow running endpoints, or only reading: a read-only app can search the catalog and read past results, but can't run anything or spend credits;

• keep it to one platform: it can't see or run anything else;

• tick extra permissions: your balance and usage, feedback, and collections. Each is off unless you tick it.

What you approve stays: a connection never gains permissions by itself, and refreshing its sign-in never widens it. To change it, disconnect the app in the console and connect it again.

The scopes behind it

Apps that request access in code use these scopes. Use exactly one base scope; the others narrow it or add to it.

When platforms and endpoints are both listed, a call must fit both. Limits never add access the account doesn't have. For example, mcp:read platform:amazon can read Amazon results and nothing else.

Good to know

• An app that may read results can read the results of other apps on the account, within its platform limits.

• The account permission shows totals for the whole account, including other apps' use, even when the app is kept to one platform.

• Pinning tools or choosing a profile changes what the agent sees, never what it may do.

• With an API key instead of sign-in, the same limits are set on the key; see Connect with an API key.