Scopes and consent

Exactly what you are granting an AI agent, and how to take it back.

The scopes

Scope	Grants
`identity:read`	Who the agent is acting as, and which workspace
`monitors:read`	List monitors, read status, heartbeats and statistics
`monitors:write`	Create, update, delete, pause, resume, check now, acknowledge
`status_pages:read`	Read status pages and their components
`status_pages:write`	Create and update status pages, publish and unpublish
`incidents:read`	Read incidents and their updates
`incidents:write`	Open, update, resolve and reopen incidents
`notifications:write`	Manage notification channels and send tests
`maintenance:write`	Schedule maintenance windows

Presets

Preset	Scopes	Good for
Read only	`monitors:read`, `status_pages:read`, `incidents:read`, `identity:read`	Summarising, investigating, reporting
Operate	Read only, plus `monitors:write`, `notifications:write`, `incidents:write`, `maintenance:write`	Day-to-day on-call assistance
Full	Everything above plus `status_pages:write`	An agent you have come to trust

Read only is the right starting point, and it is more useful than it sounds — most of what people want from an agent is “tell me what is wrong”, which needs no write access at all.

What no scope can grant

Not available to any agent
`MANAGE_BILLING`
`MANAGE_MEMBERS`
`MANAGE_WORKSPACE`
`VIEW_AUDIT_LOG`

These are session-only. An agent can never change your subscription, add members, alter workspace settings, or read the log of its own activity.

When an agent connects over the hosted OAuth flow, you are shown a consent screen naming the client, the workspace it will act in, and the three presets above in plain language. Nothing is granted until you approve.

You choose the preset, not the client. What a client asks for is a ceiling for that authorization attempt, not a grant. Codex, for one, asks for every scope Glowo publishes; the screen still opens on Read only, and what you approve there is what the agent gets. A later attempt can ask for a different set, so the ceiling is per-connection, not permanent.

Grants are workspace-scoped: approving an agent in one workspace gives it no access to another.

Reviewing and revoking

Connected agents are listed in the dashboard under Connections, and over the API:

GET  /mcp/grants
POST /mcp/grants/revoke-batch

Revocation takes effect immediately.

Advice

Grant read-only first, and widen only when you have a concrete reason.
One grant per client. Separate grants for your editor and your terminal agent mean you can revoke one without disturbing the other.
Check the audit log after the first few sessions to see what the agent actually did.