Permissions

The reach of a connection is its scope intersected with its owner's current access. It is recomputed on every request. list_accounts returns the accounts a connection can reach, with an identifier, a name and import freshness. Read-only tools are available to every connection; administrative tools are visible only to administrators. Connections are reviewed on the connections page. Choose accounts at sign-in; see connect. Only one tool changes data on a member's behalf, save_scenario, and only when all of these hold on the request: the connection or key is allowed to change data, the owner has turned on Agents may change data for them on that account, the owner may use the Model Calculator (administrator, or Agency Model use), and the account is one the connection reaches. A saved scenario belongs to the person who owns the connection, so only they or an administrator can change it later. The scenario tools (list_scenarios, get_scenario, save_scenario) and the scenarioId option of get_capacity_plan and get_agi_report need the same Model Calculator access. list_payroll_entries, list_changes and get_change_batch require People grid view on the account, or an administrator. Whatever a connection changes is recorded in the account's change log with the client name, the person whose credentials connected it and the optional reason it gave, and is visible to the account's people. Administrative tools need an administrator's opted-in connection, and API keys never grant them.

Live documentation resources and search_docs require authentication but no account selection or reachable account. All live pages are available regardless of their editorial audience tags. Preview and internal documentation is listed, readable and searchable only on an administrator's OAuth connection opted in to administrative tools. An administrator's ordinary OAuth connection and every API key see only live pages. This documentation access does not change account access checks on other tools.

Compensation and person-level data

Per-person compensation, cost per delivery hour by person and payroll rows are served to an assistant only when the connection owner has People (payroll) grid view on that account. Nobody without payroll grid access sees them through any tool. The check uses the owner's own membership on the account, read on every request; an owner with no membership on the account gets nothing. Administrator status adds no reach here, so an administrator's connection sees what their own membership row allows.

Aggregates stay available without People view, as the app shows that member: account-level totals inside the planned reports, hours, capacity and utilization. Where a tool holds a compensation-derived field, it omits the field and returns a compensation-withheld caveat rather than a zero or a blank. Today that is cost per delivery hour in get_saved_estimate, Direct Delivery Margin in estimate_project and payroll rows in get_scenario (with includeRows). Missing-row names and dates are also withheld without People grid view, even when includeRows is false; missingRows is then empty and a rows-withheld caveat explains why.

The grid listings list_project_entries and list_expense_entries need at least view access to that grid, and get_agi_report and get_finance_forecast need view access to the Projects grid, matching the app. list_payroll_entries is unchanged: it needs an administrator or Payroll Grid or Model Calculator access and returns no compensation.