> ## Documentation Index
> Fetch the complete documentation index at: https://docs.auxilian.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> Exactly who can see and change what in Auxilian, for people and the AI assistants acting for them.

Auxilian checks permissions on the server for every request, from the web app and from MCP tools alike. An AI assistant has exactly the permissions of the person who connected it, limited further by the connection's [scope](/ai/approvals-and-access#read-and-write-access).

## How project access is decided

<Steps>
  <Step title="Workspace membership">
    You must be a member of the project's workspace. Without membership you have no access, even to a project you created.
  </Step>

  <Step title="Creator">
    If you created the project, you have write access.
  </Step>

  <Step title="Workspace owner or admin">
    If you are the owner or an admin of the project's workspace, you have write access.
  </Step>

  <Step title="Project grant">
    Otherwise, your access is the permission someone granted you on the project: **read** or **write**. With no grant, you have no access.
  </Step>
</Steps>

A project you can't access behaves as if it doesn't exist. The web app shows a not-found page, and MCP tools return `Access denied`.

## Project permissions

| Action | Read | Write |
| - | :-: | :-: |
| View schema, tables, and rows | Yes | Yes |
| View the activity log | Yes | Yes |
| Export CSV | Yes | Yes |
| Create and drop tables, add and drop columns | No | Yes |
| Insert, edit, and delete rows | No | Yes |
| Share the project, change grants, revoke access | No | Yes |
| Delete the project | No | Creator, workspace owner, or admin only |

## Workspace roles

| Action | Owner | Admin | Member |
| - | :-: | :-: | :-: |
| Create projects | Yes | Yes | No |
| Write access to every project in the workspace | Yes | Yes | No |
| Delete any project in the workspace | Yes | Yes | No |
| Rename the workspace | Yes | Yes | No |
| View members and pending invitations | Yes | Yes | Yes |
| Invite members | Yes | Yes | No |
| Invite admins | Yes | No | No |
| Revoke invitations | Yes | Yes | No |
| Change roles (admin and member) | Yes | No | No |
| Remove members (except the owner and yourself) | Yes | Yes | No |

## AI assistant connections

| Connection scope | Can do |
| - | - |
| `mcp:read` | Everything your read access allows, through read tools |
| `mcp:read` + `mcp:write` | Everything your access allows, through all tools |

Regardless of scope, assistants can't share projects, manage members or invitations, rename workspaces, delete projects, view the activity log, export CSV, or delete accounts. Those actions are only in the web app.

## When access changes

Changes take effect on the next request, for people and assistants:

* **Removed from a workspace:** all access to its projects ends, including projects you created. Your project grants in that workspace are deleted.
* **Demoted from admin to member:** implicit write access to the workspace's projects ends. Projects you created and projects shared with you remain.
* **Grant revoked:** access to that project ends.

## Safeguards

* A project always keeps its creator, and at least one person with write access. Auxilian refuses to revoke the creator or the last writer.
* Projects can only be shared with members of the project's workspace.
* Refused writes are recorded in the project's activity log as `write.denied`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.