Get started
Scopes and permissions
What each scope allows, and which also need a permission on the account behind the token.
A scope is permission to use a permission, never a source of one. A token holding crm.value still sees no deal amounts unless the person behind it may. 49 scopes can be granted, and none implies another.
Named scopes
Some scopes are only ever granted by name, because what they reach is sensitive or noisy —
feed.post, for example, notifies colleagues’ phones. They are marked below.Work
| Scope | Allows | Also needs |
|---|---|---|
projects.read | Read products. Products, their stage, team, links and requirements. | — |
work.read | Read work. Issues, their status, schedule and history. | — |
work.write | Change work. Open, edit, schedule and close issues. Putting work on a person is checked separately. | — |
ideas.read | Read ideas. The idea inbox, its signals and decisions. | — |
ideas.write | Change ideas. File ideas, add evidence, park or kill them. | — |
prototypes.read | Read prototypes. The shelf, its trials and verdicts. | — |
pages.read | Read pages. Pages and documents, and their version history. | — |
pages.write | Change pages. Write and edit pages and documents. Publishing one is a separate scope. | — |
ideas.runnamed | Pressure-test ideas. Run the agent against an idea for the case against it. Uses one run from the plan each time. | — |
calendar.read | Read the calendar. Your meetings and teammates' busy time, and finding a free slot. | — |
calendar.write | Schedule meetings. Create, move and cancel meetings you organize, answer invitations and start notes. Guests are notified. | — |
time.read | Read your time. Your running timer and your own time entries. Never rates, costs or anybody else's time. | — |
time.write | Track your time. Start and stop your timer and log time against products and tasks, as you. Never rates, approvals or other people's time. | — |
goals.read | Read goals. Objectives, key results, progress and check-ins you can see. Others' private goals and deal amounts you may not view are never returned. | — |
goals.write | Check in on goals. Post a check-in, with status and key result numbers, on goals you own (any goal, if you are a workspace admin). Never creates, edits or deletes a goal. | — |
roadmap.read | Read the roadmap and changelog. Initiatives, milestones and the changelog's posts with their status. Read only: nothing is published, scheduled or emailed. | — |
expenses.read | Read your expenses. Your own expense claims with status and totals. Never receipts, other people's claims or reimbursement details. | — |
expenses.write | File your expenses. Add an expense and send it for approval, attach a receipt to your own draft (the Atrix app only; MCP carries no files), or delete your own draft, as you. Never approvals or reimbursement. | — |
projects.write | Change products. Start a product, edit its identity, move its stage. | Manage products |
Customers
| Scope | Allows | Also needs |
|---|---|---|
crm.read | Read customers. Companies, contacts, deals and their notes. Deal amounts stay hidden unless you may see them. | — |
crm.valuenamed | See deal values. Amounts and pipeline totals. Reading customers does not include this. | See deal values |
crm.write | Change customers. Add and edit companies, contacts and deals, move them along, log notes. | — |
invoices.readnamed | See invoices and quotes. Numbers, customers, statuses, totals and line items. Never payment links, bank details or tax ids. | Manage invoices and quotes |
invoices.writenamed | Draft invoices and quotes. Create draft invoices and quotes for existing customers. Drafts are never sent, numbered or collected by a token. | Manage invoices and quotes |
People
| Scope | Allows | Also needs |
|---|---|---|
hiring.read | Read hiring. Roles and applications. Applications are a candidate's personal data. | Run hiring |
people.read | Read the team. Who is here and what they do. Employment records need your own permission on top. | — |
people.recordsnamed | See employment records. Start dates, terms, contact and emergency details. Reading the team does not include this. | See employment records |
profile.read | Know who you are. Your name, email, picture and role in this workspace. Nothing about anybody else. | — |
agreements.statusnamed | See who has signed. The signing status of agreements (awaiting, signed, expired) and dates. Never what they say, the files, or signing links. | See employment records |
agreements.signnamed | Sign your own documents. List documents waiting for your signature and open your signing link. Only ever yours — never anyone else's, and never what a document says. | — |
leave.read | Read your leave. Your own leave balance and requests, and who is out today by name. Never anybody else's reason or type of leave. | — |
leave.write | Request your leave. Ask for leave and cancel your own requests, as you. Your approvers are notified as they are in the app. Never approving or anybody else's leave. | — |
policies.read | Read your policies. The published policies, which you must acknowledge and whether you have. Never who else has acknowledged. | — |
policies.write | Acknowledge your policies. Acknowledge a policy as you, once you have read it. Never writing or publishing policies. | — |
letters.readnamed | Read your letters. Your own letter and certificate requests, their status and decision, and the signed PDF once issued. Never anybody else's request or the admin queue. | — |
letters.writenamed | Request your letters. Ask for a letter or certificate about yourself and withdraw it while it waits. Never deciding, drafting or issuing. | — |
profile.write | Change your own profile. Your picture. Not anybody else's, and not employment records. | — |
Workspace
| Scope | Allows | Also needs |
|---|---|---|
messages.read | Read messages. Only the conversations you are already in. | — |
feed.read | Read the feed. Posts, comments, reactions and polls. | — |
feed.postnamed | Post updates. Write posts and comments. Naming somebody in one notifies them, on their phone. | — |
integrations.read | Read integrations. Which repositories and tools are connected. | Manage integrations |
billing.read | Read billing. Plan, seats and usage against the limits. | Manage billing |
pulse.read | Read Pulse reports and automations. Your scheduled Pulse agents and their latest report, and (with settings access) automation rules and how they last ran. Never prompts, webhook URLs or secrets; nothing is run or changed. | — |
ask.read | Ask questions of the workspace. Cited answers drawn from pages, tasks, updates, ideas and messages this connection may already read. Uses your workspace's AI allowance. | — |
entities.read | Read legal entities. The workspace's contracting entities: name, country, governing law, registration number and registered address. Never invoice payment details or tax ids. | — |
onboarding.read | Read your onboarding checklist. Your own onboarding steps and progress. Never anyone else's, and never identity or bank details. | — |
onboarding.write | Tick your onboarding steps. Tick or untick the steps of your own onboarding checklist that are yours to do. Never anyone else's checklist. | — |
messages.write | Send messages. Post into conversations you are already in. Removing somebody else's message is separate. | — |
devices.write | Register a device for notifications. Lets a phone ask to be told about mentions, replies and work in your name. | — |
Never grantable
Pay is outside what any token can be granted: no scope reaches a salary and no endpoint selects a compensation record.