Start with a helper
The permission selector provides shortcuts for common integrations:
| Helper | Use it for |
|---|---|
| Read only | Reporting, search, and synchronization that only retrieves data |
| Read and edit | Integrations that create or modify selected shared records |
| App selection | Group relevant resources and operations by the app they belong to |
| Custom | Select individual resources and operations |
Helpers produce concrete permissions for review. Adding a new operation later does not silently broaden an existing credential. App selection includes the relevant shared platform resources used by that app.
Identity and grant work together
A personal MCP connection has the intersection of the member's live access and the connection's grant. A workspace key or workspace MCP connection starts with its approved shared-data grant. An administrator may also approve member delegation. Each delegated call intersects that grant with the selected member's current access, including private records.
Read-only access excludes commands. Resource restrictions also apply to generic record operations, nested operations, and background work started by a call. An operation's availability does not override the workspace boundary or private-record access rules.
Some shared resources retain steward restrictions. Workspace connections cannot update or delete another steward's records merely because a grant includes the type. The workspace helper excludes these edits where needed, including shared meeting templates; personal connections and delegated requests retain the selected member’s existing stewardship permissions.
Sensitive actions
The authenticated catalogue contains callable operations only. It does not include human-only actions, and there is no approval flag to check on every call.
| Workflow | API support | Human step |
|---|---|---|
| Read and update approved records | Call the published operation with the required grants | Approve the credential once in Settings |
| Configure a webhook | Prepare the subscription and its resource selection | An administrator reviews and enables it in Brigg |
| Support replies and newsletters | Prepare or edit the content | A person approves sending in Brigg |
| Automations | Read, pause or delete existing rules | Create or resume them in Brigg |
| File signing | Upload the file, request signatures and read progress | Each recipient signs; the API cannot sign for them |
| Workspace API keys and provider connections | Read the published management views | Create keys and complete provider consent in Brigg |
Sending, spending, access changes and sensitive exports require individual operation selection where the permission selector marks them as sensitive. Preparation never grants permission to perform the later human step. Each workflow guide identifies that step explicitly.
Diagnose refused calls
A 403 response means the credential lacks access to the operation or its resources. Use the credential's authenticated catalog to see what it can call. Review the grant in Settings when the integration needs additional access; do not automatically retry a permission refusal.