---
title: Scopes and consent
description: Exactly what you are granting an AI agent, and how to take it back.
sidebar:
  label: Scopes & consent
---

{/* Source of truth: packages/shared/src/mcp.ts — McpScopes,
    McpScopePresets (READ_ONLY, OPERATE, FULL), McpScopeLabels.
    Grants: /mcp/grants, /mcp/grants/revoke-batch; dashboard
    /oauth/consent and /oauth/connections. */}

## The scopes

| Scope | Grants |
| --- | --- |
| `identity:read` | Who the agent is acting as, and which workspace |
| `monitors:read` | List monitors, read status, heartbeats and statistics |
| `monitors:write` | Create, update, delete, pause, resume, check now, acknowledge |
| `status_pages:read` | Read status pages and their components |
| `status_pages:write` | Create and update status pages, publish and unpublish |
| `incidents:read` | Read incidents and their updates |
| `incidents:write` | Open, update, resolve and reopen incidents |
| `notifications:write` | Manage notification channels and send tests |
| `maintenance:write` | Schedule maintenance windows |

## Presets

| Preset | Scopes | Good for |
| --- | --- | --- |
| **Read only** | `monitors:read`, `status_pages:read`, `incidents:read`, `identity:read` | Summarising, investigating, reporting |
| **Operate** | Read only, plus `monitors:write`, `notifications:write`, `incidents:write`, `maintenance:write` | Day-to-day on-call assistance |
| **Full** | Everything above plus `status_pages:write` | An agent you have come to trust |

**Read only** is the right starting point, and it is more useful than it sounds
— most of what people want from an agent is "tell me what is wrong", which needs
no write access at all.

## What no scope can grant

| Not available to any agent |
| --- |
| `MANAGE_BILLING` |
| `MANAGE_MEMBERS` |
| `MANAGE_WORKSPACE` |
| `VIEW_AUDIT_LOG` |

These are session-only. An agent can never change your subscription, add
members, alter workspace settings, or read the log of its own activity.

## Consent

When an agent connects over the [hosted OAuth flow](/ai-agents/connecting), you
are shown a consent screen naming the client, the workspace it will act in, and
the three presets above in plain language. Nothing is granted until you approve.

**You choose the preset, not the client.** What a client asks for is a ceiling
for that authorization attempt, not a grant. Codex, for one, asks for every
scope Glowo publishes; the screen still opens on **Read only**, and what you
approve there is what the agent gets. A later attempt can ask for a different
set, so the ceiling is per-connection, not permanent.

:::caution
The preset has to fit inside what the client asked for. Approving one that
reaches wider is refused with `invalid_request: Scope not originally requested`
— the server never quietly widens or trims a grant to make it fit.

A client that asks for less than a whole preset therefore cannot be approved at
all: the screen offers the same three presets regardless of what was requested,
so if none of them fits inside the request, every choice is refused. Widen what
the client asks for, or connect it over the
[local transport](/ai-agents/connecting#local) with a scoped API key instead.
:::

Grants are workspace-scoped: approving an agent in one workspace gives it no
access to another.

## Reviewing and revoking

Connected agents are listed in the dashboard under **Connections**, and over the
API:

```http
GET  /mcp/grants
POST /mcp/grants/revoke-batch
```

Revocation takes effect immediately.

:::caution
Review connections periodically, the way you would API keys. An agent you tried
once and forgot keeps its grant until you remove it.
:::

## Advice

- **Grant read-only first**, and widen only when you have a concrete reason.
- **One grant per client.** Separate grants for your editor and your terminal
  agent mean you can revoke one without disturbing the other.
- **Check the audit log** after the first few sessions to see what the agent
  actually did.