Skip to content

Roles, limits and security

An AI assistant acts with the rights of the user who connected it – never with more. In addition, the administrator decides per person whether the assistant may only read or also write, and per account how much is allowed within an hour. Every decision is made on the server and logged. What the assistant itself "promises" is irrelevant for security.

The three roles

Assigned under Administration → Manage users. The two add-on roles only work together with the first one.

Role Effect
Connect external AI assistants (MCP) Connection allowed. The assistant reads: data, analytics, processes, tasks.
External AI assistants (MCP): write records directly Additionally: create and change records.
External AI assistants (MCP): start processes and complete tasks Additionally: start processes and complete tasks.

"Process only" mode: If only the third role is assigned, the assistant can change data exclusively through the processes the company defined – for example "Create contact" with the checks built into it. Editing records directly is not possible then.

Administrators do not get any of these roles automatically. For them, too, the access is a deliberate decision.

Rights from the app still apply

  • Data schemas: Permissions from the Data Designer (list, read, create, update) apply to the assistant in the same way. A record from a schema without read permission is not delivered, not even as a reference inside another record.
  • Processes and tasks: Only start events and tasks assigned to the user or one of the user's groups can be started or completed.
  • Analytics: SQL queries run only over tables the user is allowed to access.
  • Deleting: is never possible through the assistant.

Limits & switches

Under Administration → AI assistants → Limits & switches the following applies to the whole account:

Switches

  • AI assistants allowed: The main switch, off by default. An administrator switches it on once before assistants can be used. Off means: no access, not even reading. Connected assistants no longer see any tools. Roles are kept – which makes the switch the kill switch as well.
  • Write records directly: creating and changing by assistants.
  • Start processes and complete tasks.

Limits per user and hour (defaults in brackets)

  • Create and change records (200)
  • Start processes (50)
  • Complete tasks (100)

The limits are a brake against loops and misunderstandings. Once a user reaches a limit, Pantarey refuses further calls of that kind until the next full hour. The assistant tells the user and points to the app or the administrator. Counting uses fixed hour windows (full hour, UTC). The value 0 blocks that kind of call.

Changes take effect immediately for all users of the account.

Log

Every call of an assistant is recorded in the table prio_mcp_usage_statistics in Analytics:

Column Content
user_email, client Who, with which assistant
tool Which tool
result ok, rejected, denied (no permission), invalid, error
decision, guard Decision of the check (allow, approval_required, deny) and which check made it (switches, budget, permission)
target_ids, produced_id Affected ids and – for writing calls – the created id
policy_version Version of limits & switches at the time of the call
duration_ms, execution_timestamp Duration and time

Record contents or SQL texts are not logged, only a hash of the arguments.

Example query:

SELECT execution_timestamp, user_email, tool, result, decision, guard
FROM prio_mcp_usage_statistics
ORDER BY execution_timestamp DESC
LIMIT 50

Example

An employee is supposed to analyze invoices via chat but change nothing. He only gets the role "connect". His assistant can search, read and run SQL queries. If he tries to create a record, the tool for it simply does not exist.

Tips

  • Grant step by step: First "connect", look at the log after a few days, then assign the writing roles.
  • Suspected misbehaviour: Flip the kill switch, check the log, then withdraw a role deliberately.
  • Adjust limits: The log shows how many calls per hour actually occur.