> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gatetrix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Profiles and permissions

> Understand agent and human profiles, mobile roles, resource grants, operation policies, and Configuration Mode.

Access has two profile types: **agent profiles** for MCP and CLI clients, and
**human profiles** for people using the iOS app or Mobile API. Credentials belong
to a profile; creating a credential does not by itself grant new resources.

## Agent profiles

Create separate agent profiles when agents need different resources, different
approval rules, or a distinct identity in the audit log. An agent profile combines
resource grants, allowed operations, approvals, and setup permissions.

## Configure the intended scope

1. Select the agent profile in **Configuration**.
2. In **Folders**, grant the locations the profile needs.
3. In **Connectors**, grant the relevant connections and configure their available
   operations and approval requirements.
4. Create an MCP credential for that profile and use it in the intended client.

The profile selected in the configuration sidebar determines what you are editing.
The global MCP transport settings apply to the app's access channels.

## Four separate decisions

| Decision | Example |
| - | - |
| Which identity? | The agent uses the research profile's credential. |
| Which resources? | That profile can use one selected connection or folder. |
| Which operations? | It can read records but cannot delete them. |
| Which approvals? | A permitted write needs an owner's decision before execution. |

An approval is a decision about an operation already subject to the profile's
permissions. It does not grant general access to a service.

For an upstream MCP connection, review the discovered tools and enable only the
ones the profile needs. New or changed tools need review. Restrictions inside
an upstream tool also depend on the upstream application's own access controls.

## Configuration Mode

Configuration Mode lets an agent prepare or update supported connection definitions
within the profile's setup permissions. Its duration is separate from the
connection's ordinary runtime grants.

Copying a setup prompt does not enable it. Closing the setup window blocks further
setup operations; it does not automatically revoke an existing connection's
runtime access.

## Change or remove access

Update the profile's grants or operation rules in Access. Revoke an MCP credential
when that client should no longer use it. These controls affect calls through
Access; they do not revoke permissions the agent has independently elsewhere.

## Human profiles

Create these under **Human Profiles** in the Mac app. Give each person or device
a suitable role and a mobile credential. Agent MCP credentials cannot be used
as human Mobile API credentials.

| Role | Visibility and actions through the Mobile API |
| - | - |
| **Viewer** | Read state, tasks, updates, and schedules in selected workspaces. |
| **Operator** | Viewer access, plus creating tasks and marking status updates read. |
| **Admin** | All workspaces, including approval and audit data; can decide approvals, complete/cancel tasks, and manage schedules and run outcomes. |

Operators and Viewers need explicitly selected workspaces and cannot access
unscoped work. Mobile Admins have wider operational access, but cannot configure
connectors, folder grants, profile permissions, or access channels through the
Mobile API. Those actions stay in the Mac app.

See [iOS app](/access/ios), [Mobile API](/access/mobile-api), and the
[security model](/access/security-model).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.