Users, roles and tool permissions

You decide who your agents act as, which systems they can reach, and which operations they may run. Access is least-privilege by design. A platform stays hidden until you turn it on, and every tool call is checked against your permissions before it reaches the connected system.

MCP users

An MCP user is a person an agent acts for. MCP users sign in from their agent with a one-time code sent to their email. They have no password and no access to the dashboard. Each one connects their own accounts, so a tool call runs with that person's own access in the connected system.

There are two ways to add one:

Invite someone. Open Users → MCP users and click Invite MCP user. Enter their email address, an optional name and a role. Makini emails them the connector URL and how to add it to their agent.

Give a team member a seat. On the Users tab, turn on the MCP access switch next to a member. They sign in from their agent with the email address they already use for Makini.

From a user's row menu you can:

Edit them: change their role or disable them. A disabled user keeps their connections, but every tool call is blocked until you enable them again.

Send invitation email again, if the first one didn't arrive.

Remove them.

If your plan includes a set number of MCP seats, the page shows how many are in use.

Roles

Every MCP user holds one role, and the role decides which tools they can reach. Roles are listed beside the users, and selecting one filters the list.

Default is built in. It reaches everything the application allows, and new MCP users get it unless you choose otherwise.

Create roles for narrower access, such as "Maintenance planners" or "Read-only analysts". Tick Make this the role new MCP users get to make a role the default for new users.

Changing a user's role applies right away, including to the connections they already have.

Deleting a role that still has users asks where to move them first.

Tool permissions

Open Platforms and click Permissions on a platform. The page lists every tool the platform offers, with a search box, and has three scopes:

Scope	What it sets
Everyone	The ceiling for the whole application. A tool disabled here is disabled for every role and user.
Roles	What each role may run, within the ceiling.
Users	Exceptions for one MCP user, within the ceiling. They take priority over that user's role.

At each scope, set a Default (Enable all or Disable all) and then tick or untick individual tools as exceptions. Click Save changes to apply the exceptions. Tools blocked by the application ceiling appear struck through and can't be changed at the role or user level.

A tool runs only when all of these hold:

The platform is visible.

The application-level permissions allow the tool.

The user's own setting allows it, or, if they have none, their role's does.

Start narrow

A common pattern: set Everyone to allow the read operations your team needs plus a few writes, such as creating work orders. Then give broader write access only to the roles that need it.

Search results show every operation on a platform, but a disabled tool is refused when the agent tries to run it. Agents are instructed to stop and tell the user that an administrator can enable it, instead of looking for another way in.

Platform visibility

Platforms controls which systems this application can connect to. MCP applications show only the platforms you turn on, and platforms Makini adds later start hidden, so nothing new reaches your agents without a decision from you.

Turning a platform on lets MCP users connect it through Makini Link.

Hiding a platform stops every tool on it. Existing connections aren't deleted.

Show all and Hide all change every platform at once.

Company-wide credentials

Some platforms need values that are the same for your whole organization, such as a server address or a tenant ID. Set them once, and each user is asked only for their own sign-in details when they connect.

On Platforms, click Set up in the Company-wide credentials column.

Fill in the fields and save.

Stored values are never shown again. Replace overwrites all of them, so re-enter every field. Saving also updates the existing connections to that platform. Clear them stops Makini supplying the values to new connections, and existing connections keep working. If a platform asks each user for their own credentials only, the dialog says so and there is nothing to set.

Test with the MCP explorer

MCP explorer runs tools exactly as an agent would: as one MCP user, against that user's own connection, through the same tool permissions.

Pick an MCP user and a platform.

Search the tools and select one.

Fill in the arguments, grouped the same way as the tool's input schema, and click Run tool.

If the user hasn't connected the platform yet, the explorer gives you a link to send them. Tools that the user's permissions switch off are marked, and can't be run from the explorer either. Operations that change data carry a warning, because they write to the connected system.

Monitor with MCP logs

Monitoring → MCP logs records every tool call your agents make. Filter by tool or by MCP user, and open a call to see its arguments and the response.

Next steps

MCP quickstart: connect your first agent.

Provider mode: agents for your customers: manage users, roles and permissions for each of your customers through the Management API.

Users, roles and tool permissions

MCP users#

Roles#

Tool permissions#

Platform visibility#

Company-wide credentials#

Test with the MCP explorer#

Monitor with MCP logs#

Next steps#

MCP users

Roles

Tool permissions

Platform visibility

Company-wide credentials

Test with the MCP explorer

Monitor with MCP logs

Next steps