Skip to main content
Auxilian checks permissions on the server for every request, from the web app and from MCP tools alike. An AI assistant has exactly the permissions of the person who connected it, limited further by the connection’s scope.

​
How project access is decided

1

Workspace membership

You must be a member of the project’s workspace. Without membership you have no access, even to a project you created.
2

Creator

If you created the project, you have write access.
3

Workspace owner or admin

If you are the owner or an admin of the project’s workspace, you have write access.
4

Project grant

Otherwise, your access is the permission someone granted you on the project: read or write. With no grant, you have no access.
A project you can’t access behaves as if it doesn’t exist. The web app shows a not-found page, and MCP tools return Access denied.

​
Project permissions

​
Workspace roles

​
AI assistant connections

Regardless of scope, assistants can’t share projects, manage members or invitations, rename workspaces, delete projects, view the activity log, export CSV, or delete accounts. Those actions are only in the web app.

​
When access changes

Changes take effect on the next request, for people and assistants:
  • Removed from a workspace: all access to its projects ends, including projects you created. Your project grants in that workspace are deleted.
  • Demoted from admin to member: implicit write access to the workspace’s projects ends. Projects you created and projects shared with you remain.
  • Grant revoked: access to that project ends.

​
Safeguards

  • A project always keeps its creator, and at least one person with write access. Auxilian refuses to revoke the creator or the last writer.
  • Projects can only be shared with members of the project’s workspace.
  • Refused writes are recorded in the project’s activity log as write.denied.