What Access controls
Calls made through Access are checked against their credential, profile grants, operation rules, approvals, and rate limits. Connector credentials are kept in macOS Keychain and used by Access to contact the configured service. Configuration Mode separately controls when an agent may prepare connection definitions. An approval applies to the requested operation within its existing permissions; it does not grant unrestricted access.Where the boundary ends
Like any software, Access can contain bugs. A defect in permission enforcement could allow an agent to do more through Access than your configured permissions intend. Do not treat a profile as an absolute isolation guarantee. Access also does not restrict an agent’s independent shell, filesystem, browser, or service access. A local MCP server runs as your macOS user; Access does not sandbox that program’s own behavior. Upstream tools and APIs retain their own semantics and permission controls. Keeping a service credential out of an agent’s prompt does not keep tool results out of its context. Data returned to an agent may be processed by its provider. See Privacy and Data and permissions.Choose a smaller scope
- Give each agent only the connections and operations needed for its task.
- Use restricted provider tokens, selected accounts, and limited database roles as additional controls. Access rules do not replace those restrictions.
- Review upstream MCP tools and local executables before enabling them.
- Require approval for consequential operations and review audit activity.
- Close Configuration Mode when setup is finished, revoke unused credentials, and keep Access updated.