Skip to main content
The Codenull Agent does not look at your role’s permissions directly. Your session is treated as an MCP API key that asked for every scope, and the same policy that governs API keys decides which scopes survive. The agent then mounts only the tools behind the surviving scopes. A tool you cannot use is not refused: it is simply not there.
Flow from the user session to the agent permissions, the enforcement gate, the MCP scopes and the tools the agent mounts

Permissions become scopes, the data scopes pass through the enforcement gate, and each surviving scope mounts its tools. Admins skip the gate.

​
What each permission unlocks

Permissions add up. A designer who also has AI Search gets the configuration tools plus data reads. A role with only AI Search gets exactly two tools: the data query and the schema.

​
The enforcement gate

data:read and data:write only survive when the application enforces per-entity permissions. Without enforcement, the GraphQL resolvers only check that the caller is authenticated, so those two scopes would give the agent every table in the application regardless of the user’s role. Rather than take that risk, the platform drops them. What a non-admin user sees in an application without enforcement:
  • Only AI Search or AI Transactions. No scope survives. The chat answers that an administrator must enable per-entity permission enforcement for the application before queries and transactions work. It is not a missing-permission message: the role does have the permission.
  • AI Designer plus AI Search. Configuration tools work as usual. When the user asks for data, the agent explains the same cause in that turn instead of guessing.
  • Admin. Unaffected. Admins already bypass entity permissions, so they keep the data tools.
A user with none of the three permissions gets a plain “no permission” answer in every case, naming the permissions that would grant access.
Enforcement is an application setting managed by your administrator (PERMISSIONS_ENFORCEMENT_ENABLED). Enabling it also activates per-entity and per-feature permission checks across the whole application, not only in the chat. The MCP server page describes the same rule for API keys.

​
Two layers, two different questions

  • Agent permissions decide which tools are mounted. This is the flow in the diagram. It happens once per chat turn, from your role.
  • Entity and feature permissions decide which tables and records those tools can reach. They run inside execute_data_query and execute_data_mutation, in the same GraphQL resolvers your application uses. They exist only when enforcement is enabled, which is why the first layer requires enforcement before handing out the data tools.

​
Operations that wait for your approval

Whatever the permission, these writes never run on their own: hooks, environment variables, role permissions, every deletion, and every business-data mutation. The agent shows a confirmation card with the exact arguments. Features, tables, menus and architecture decisions apply directly and show the diff of what changed.