The assistant stays inside the person's permissions

What moves

Every tool the Copilot or an API token can call is checked against the caller's licence and permissions, and a company-wide deny list narrows it further.

Before you start

• AI Copilot or an API token created in Settings
• AI Copilot in your plan

Step by step

1. Tenant adminSecurity, Access & Compliance

   Creates an API token with chosen tool scopes and, optionally, a company-wide deny list.

   You see:The token and the deny list are saved.

2. Outside applicationAI Copilot

   Calls a tool using the token.

   You see:The call is checked for token scope, licence, permission and the deny list.

3. SystemSecurity, Access & Compliance

   Refuses anything the token's owner could not do.

   You see:The outside tool only ever sees what the person may see.

4. Tenant adminSecurity, Access & Compliance

   Revokes the token when the integration ends.

   You see:The next call is refused.

Related

• AI Copilot
• Security, Access & Compliance
• The Copilot and your AI agents use one catalogue and one company brief
• The Copilot can query and build in Insights
• The Copilot reads and runs the catalogue and the shop
• A manager clears every queue waiting on them in one pass
• An admin hands a developer a limited assistant token
• Connections between modules