Get started
Scopes and permissions
What each scope allows, and which also need a permission on the account behind the token.
A scope is permission to use a permission, never a source of one. A token holding crm.value still sees no deal amounts unless the person behind it may. 49 scopes can be granted. A write scope brings its own read scope with it (you cannot safely change what you cannot see); named scopes are never implied by anything.
Named scopes
Some scopes are only ever granted by name, because what they reach is sensitive or noisy —
feed.post, for example, notifies colleagues’ phones. They are marked below.Work
| Scope | Allows | Also needs |
|---|---|---|
projects.read | Read products. Products, their stage, team, links and requirements. | — |
work.read | Read work. Issues, their status, schedule and history. | — |
work.write | Change work. Open, edit, schedule and close issues. Putting work on a person is checked separately. | — |
ideas.read | Read ideas. The idea inbox, its signals and decisions. | — |
ideas.write | Change ideas. File ideas, add evidence, park or kill them. | — |
prototypes.read | Read prototypes. The shelf, its trials and verdicts. | — |
pages.read | Read pages. Pages and documents, and their version history. | — |
pages.write | Change pages. Write and edit pages and documents. Publishing one is a separate scope. | — |
ideas.runnamed | Pressure-test ideas. Run the agent against an idea for the case against it. Uses one run from the plan each time. | — |
calendar.read | Read the calendar. Your meetings and teammates' busy time, and finding a free slot. | — |
calendar.write | Schedule meetings. Create, move and cancel meetings you organize, answer invitations and start notes. Guests are notified. | — |
time.read | Read your time. Your running timer and your own time entries. Never rates, costs or anybody else's time. | — |
time.write | Track your time. Start and stop your timer and log time against products and tasks, as you. Never rates, approvals or other people's time. | — |
goals.read | Read goals. Objectives, key results, progress and check-ins you can see. Others' private goals and deal amounts you may not view are never returned. | — |
goals.write | Check in on goals. Post a check-in, with status and key result numbers, on goals you own (any goal, if you are a workspace admin). Never creates, edits or deletes a goal. | — |
roadmap.read | Read the roadmap and changelog. Initiatives, milestones and the changelog's posts with their status. Read only: nothing is published, scheduled or emailed. | — |
expenses.read | Read your expenses. Your own expense claims with status and totals. Never receipts, other people's claims or reimbursement details. | — |
expenses.write | File your expenses. Add an expense and send it for approval, attach a receipt to your own draft (the Atrix app only; MCP carries no files), or delete your own draft, as you. Never approvals or reimbursement. | — |
projects.write | Change products. Start a product, edit its identity, move its stage. | Manage products |
Customers
| Scope | Allows | Also needs |
|---|---|---|
crm.read | Read customers. Companies, contacts, deals and their notes. Deal amounts stay hidden unless you may see them. | — |
crm.valuenamed | See deal values. Amounts and pipeline totals. Reading customers does not include this. | See deal values |
crm.write | Change customers. Add and edit companies, contacts and deals, move them along, log notes. | — |
invoices.readnamed | See invoices and quotes. Numbers, customers, statuses, totals and line items. Never payment links, bank details or tax ids. | Manage invoices and quotes |
invoices.writenamed | Draft invoices and quotes. Create draft invoices and quotes for existing customers. Drafts are never sent, numbered or collected by a token. | Manage invoices and quotes |
People
| Scope | Allows | Also needs |
|---|---|---|
hiring.read | Read hiring. Roles and applications. Applications are a candidate's personal data. | Run hiring |
people.read | Read the team. Who is here and what they do. Employment records need your own permission on top. | — |
people.recordsnamed | See employment records. Start dates, terms, contact and emergency details. Reading the team does not include this. | See employment records |
profile.read | Know who you are. Your name, email, picture and role in this workspace. Nothing about anybody else. | — |
agreements.statusnamed | See who has signed. The signing status of agreements (awaiting, signed, expired) and dates. Never what they say, the files, or signing links. | See employment records |
agreements.signnamed | Sign your own documents. List documents waiting for your signature and open your signing link. Only ever yours — never anyone else's, and never what a document says. | — |
leave.read | Read your leave. Your own leave balance and requests, and who is out today by name. Never anybody else's reason or type of leave. | — |
leave.write | Request your leave. Ask for leave and cancel your own requests, as you. Your approvers are notified as they are in the app. Never approving or anybody else's leave. | — |
policies.read | Read your policies. The published policies, which you must acknowledge and whether you have. Never who else has acknowledged. | — |
policies.write | Acknowledge your policies. Acknowledge a policy as you, once you have read it. Never writing or publishing policies. | — |
letters.readnamed | Read your letters. Your own letter and certificate requests, their status and decision, and the signed PDF once issued. Never anybody else's request or the admin queue. | — |
letters.writenamed | Request your letters. Ask for a letter or certificate about yourself and withdraw it while it waits. Never deciding, drafting or issuing. | — |
profile.write | Change your own profile. Your picture. Not anybody else's, and not employment records. | — |
Workspace
| Scope | Allows | Also needs |
|---|---|---|
messages.read | Read messages. Only the conversations you are already in. | — |
feed.read | Read the feed. Posts, comments, reactions and polls. | — |
feed.postnamed | Post updates. Write posts and comments. Naming somebody in one notifies them, on their phone. | — |
integrations.read | Read integrations. Which repositories and tools are connected. | Manage integrations |
billing.read | Read billing. Plan, seats and usage against the limits. | Manage billing |
pulse.read | Read Pulse reports and automations. Your scheduled Pulse agents and their latest report, and (with settings access) automation rules and how they last ran. Never prompts, webhook URLs or secrets; nothing is run or changed. | — |
ask.read | Ask questions of the workspace. Cited answers drawn from pages, tasks, updates, ideas and messages this connection may already read. Uses your workspace's AI allowance. | — |
entities.read | Read legal entities. The workspace's contracting entities: name, country, governing law, registration number and registered address. Never invoice payment details or tax ids. | — |
onboarding.read | Read your onboarding checklist. Your own onboarding steps and progress. Never anyone else's, and never identity or bank details. | — |
onboarding.write | Tick your onboarding steps. Tick or untick the steps of your own onboarding checklist that are yours to do. Never anyone else's checklist. | — |
messages.write | Send messages. Post into conversations you are already in. Removing somebody else's message is separate. | — |
devices.write | Register a device for notifications. Lets a phone ask to be told about mentions, replies and work in your name. | — |
Never grantable
Pay is outside what any token can be granted: no scope reaches a salary and no endpoint selects a compensation record.