> ## Documentation Index
> Fetch the complete documentation index at: https://docs.auxilian.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Approvals and access

> What the approval page shows, what read and write access allow, and how AI assistants are held to your permissions.

When an app connects to Auxilian, you approve it on a consent page. This page explains what you are approving.

## The approval page

After you sign in, Auxilian shows a page titled **Allow *app name* to use Auxilian?** It lists:

* **The app's name**, as the app registered it
* **Your account**: the email address the app will act as
* **What it can do**: read only, or read and write
* **Where access goes**: the host that receives the authorization, such as `claude.ai`

Select **Allow** only if you started the connection yourself and trust that app. Select **Cancel** to refuse. The app receives an `access_denied` error and gets no access.

<Warning>
  If you see this page without having just added a connector, close the window. Someone may be trying to get you to authorize their app.
</Warning>

## Read and write access

Auxilian has two access scopes:

| Scope | Approval page wording | Allows |
| - | - | - |
| `mcp:read` | Read your projects, tables and rows | `list_projects`, `list_tables`, `describe_table`, `list_rows` |
| `mcp:write` | Create projects and tables, and add, change and delete data | Every write and destructive tool |

The app chooses which scopes to request, and the approval page shows the result. An app that requests no specific scope gets both. Write access always includes read access.

If an app with read-only access calls a write tool, the call fails with:

```json theme={null}
{ "error": { "code": "ACCESS_DENIED", "message": "This connection was approved read-only; reconnect and grant write access to make changes" } }
```

To change a connection's access, remove it from the app and connect again.

## Your permissions still apply

Approving a connection never grants more than you already have. The app acts as you, in every workspace you belong to:

* It sees only the projects you can open.
* It writes only to projects where you have write access.
* It creates projects only in workspaces where you are an owner or admin.
* It is held to the same [limits](/reference/limits) and [rate limits](/reference/limits#rate-limits) as you.

If your access changes, the connection's access changes with it. When someone removes you from a workspace or revokes your project access, the connected app loses that access immediately.

## Accountability

Every write an app makes is recorded in the project's activity log with:

* **Actor**: you
* **Surface**: `mcp`
* **Action and details**: for example `insert_rows` with `count: 3 · table: books`

Refused writes are recorded too, as `write.denied` events, when the target project exists. See [Activity events](/reference/activity-events).

## Protections on the connection flow

* Sign-in and approval links are single use and expire after 10 minutes.
* The approval form only accepts submissions from the same browser session that opened it, and only from Auxilian's own pages.
* The approval page cannot be embedded in another site.
* Apps must use PKCE, and the redirect address must match the one the app registered.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.