Skip to main content
Access has two profile types: agent profiles for MCP and CLI clients, and human profiles for people using the iOS app or Mobile API. Credentials belong to a profile; creating a credential does not by itself grant new resources.

​
Agent profiles

Create separate agent profiles when agents need different resources, different approval rules, or a distinct identity in the audit log. An agent profile combines resource grants, allowed operations, approvals, and setup permissions.

​
Configure the intended scope

  1. Select the agent profile in Configuration.
  2. In Folders, grant the locations the profile needs.
  3. In Connectors, grant the relevant connections and configure their available operations and approval requirements.
  4. Create an MCP credential for that profile and use it in the intended client.
The profile selected in the configuration sidebar determines what you are editing. The global MCP transport settings apply to the app’s access channels.

​
Four separate decisions

An approval is a decision about an operation already subject to the profile’s permissions. It does not grant general access to a service. For an upstream MCP connection, review the discovered tools and enable only the ones the profile needs. New or changed tools need review. Restrictions inside an upstream tool also depend on the upstream application’s own access controls.

​
Configuration Mode

Configuration Mode lets an agent prepare or update supported connection definitions within the profile’s setup permissions. Its duration is separate from the connection’s ordinary runtime grants. Copying a setup prompt does not enable it. Closing the setup window blocks further setup operations; it does not automatically revoke an existing connection’s runtime access.

​
Change or remove access

Update the profile’s grants or operation rules in Access. Revoke an MCP credential when that client should no longer use it. These controls affect calls through Access; they do not revoke permissions the agent has independently elsewhere.

​
Human profiles

Create these under Human Profiles in the Mac app. Give each person or device a suitable role and a mobile credential. Agent MCP credentials cannot be used as human Mobile API credentials. Operators and Viewers need explicitly selected workspaces and cannot access unscoped work. Mobile Admins have wider operational access, but cannot configure connectors, folder grants, profile permissions, or access channels through the Mobile API. Those actions stay in the Mac app. See iOS app, Mobile API, and the security model.