--- title: "AI agent access" description: "For account owners: what a connected assistant may do, approvals, the off switch, the call log and revoking." canonical: "https://writavo.com/docs/agents" --- # AI agent access What happens when someone connects Claude, ChatGPT, Cursor, Codex or another AI assistant to your Site, and the controls you keep: what it may do, what it must ask first, and how to cut it off. ## What a connection is When a person connects an AI assistant to Writavo, through the hosted MCP server or the local one, Writavo creates an ordinary secret API key for it, bound to one Site. That key is an AI agent key: it is labelled with the app that holds it, it can only do what the person allowed, and the controls on this page apply to it. Keys made by hand in the dashboard are not agent keys and are not affected by any of this. - One connection, one Site. An assistant connected to one Site cannot see or reach another. - It can never do more than the person who approved it. If that person's role on the Site narrows, the connection narrows with it on its next request. - An agent key can never manage API keys or webhooks, whatever the approver could do. Creating credentials and pointing your Site's events at an address are kept for people. - Setting one up is described in [the MCP server guide](/docs/mcp). ## Connecting an assistant 1. **The assistant opens a Writavo page in the browser.** The person signs in to app.writavo.com, or creates an account. Nothing is pasted anywhere. 2. **The page says who is asking.** It shows the app's name and, for the hosted server, the address the browser will be sent back to. Only continue if you started this from your assistant just now. 3. **Choose the Site.** Only Sites where you can manage API keys can be chosen. A Site whose organisation has turned AI agent access off is shown but cannot be chosen. 4. **Choose the permissions, then approve.** The picker below is filled in with your organisation's default. The assistant is connected a few seconds later. ## The permission picker One row per area, and one choice per row: No access, Read, or Read and write. Site details (name, domain, timezone) are always readable and are shown as a fixed line. | Area | Read | Read and write | |---|---|---| | Articles | Read articles, drafts included | Also create, edit, publish, schedule, unpublish and delete them | | Categories, tags and authors | Read them | Also create, edit and delete them | | Media | Read the media library | Also upload images and delete them | | AI pipeline | Read the pipeline's status and queue | Read and run (spends credits): also start pipeline runs | - **Read only** sets every row to Read in one click. - Under the rows, one sentence says what the app will be able to do, for example: Claude Code will be able to read and edit articles and media, and read the pipeline. It cannot run the pipeline. - A choice you cannot grant on the chosen Site is disabled, with the reason. You can never give an assistant more than you have yourself. ## The default for new connections The picker starts from your organisation's default. Out of the box that is Read and write for articles, categories, tags and authors, and media, and Read for the AI pipeline: an assistant can manage content but cannot spend credits unless someone ticks Read and run. To change it, open Settings > AI agents > Default permissions for new connections. It uses the same picker and applies to every Site in the organisation. Changing it needs permission to manage the organisation (owners and admins, by default). It only changes what the picker starts with: connections that already exist keep what they were given. ## Approvals While approvals are on (the default), an AI agent key cannot carry out seven actions until a person says yes: deleting an article, a category, a tag, an author or a media file, unpublishing an article, and requesting an AI pipeline run. 1. **The assistant gives you a link.** It looks like https://app.writavo.com/approvals/. Nothing has happened yet. 2. **You open it and decide.** The page shows the action, the item (its title or name), the Site, which assistant asked and when the request lapses. Approve or Deny. 3. **The assistant tries again.** After you approve, it repeats the same request with the approval attached, and it goes through. After a denial it is told no and must not try again. - Anyone on the Site who could take that action themselves can decide: articles need permission to write articles, categories, tags and authors need permission to manage them, media needs permission to manage media, and a pipeline run needs permission to run the pipeline. - An approval covers exactly one request: the same action on the same item with the same details. It can be used once, and lapses after 24 hours if nobody decides. - Approval links always point at app.writavo.com. Treat a link to any other address as not from Writavo. - Pending approvals are also listed under Settings > AI agents. - An owner or admin can turn approvals off with the switch Ask before deleting, unpublishing or running the pipeline. The permissions still apply: a pipeline run still needs Read and run on the AI pipeline, and still spends credits within your spend cap. ## Turning agent access off Settings > AI agents > Allow AI agents is an organisation-wide switch, and changing it needs permission to manage the organisation. - Off: every AI agent key in the organisation is refused from its next request (`403 AGENT_ACCESS_DISABLED`), including reads of published content, and no new connection can be approved. - An assistant can still hand its own key back (sign out) while access is off. - On again: the existing connections work again at once. Nobody has to sign in again. - Keys made by hand in the dashboard are never affected. ## Seeing which apps hold a key Every connection appears under Settings > AI agents, named after the app that holds it, for example "Claude Code (hosted MCP)" or "Cursor (local MCP)". Each entry shows where it runs ("Hosted", or "On" and the computer's name for a local connection), the key prefix, its permissions in the same words as the picker, when it was created and last used, when it expires, and a Revoke button. The same keys appear in Settings > API keys with an AI agent badge, linking back to Settings > AI agents. ## The call log Settings > AI agents also lists every request an AI agent key makes, refusals included: when, which app, which MCP tool, which operation, the outcome and how long it took, newest first. Entries are kept for 90 days. Seeing the log needs permission to view logs. ## Revoking - Revoke a connection under Settings > AI agents or Settings > API keys. It stops working on its next request, and the hosted server will not renew a sign-in whose key is revoked. - Signing out in the assistant revokes the key too: the local server's `logout` tool revokes it on the server before forgetting it. - To reconnect, the person connects the assistant again and approves a new key. ## How long a connection lasts A connection's key expires 90 days after it is issued, and extends itself while it is in use: once it is within 30 days of expiry, the next use moves the expiry to 90 days from then. It is never extended past 365 days from when it was created, after which the person connects again. It is not extended if the person who approved it can no longer manage API keys on the Site, or while agent access is turned off. A connection nobody uses simply reaches its expiry date and stops. ## The security model - The hosted server generates the key on Writavo's own servers and keeps it there, encrypted inside the sign-in grant. The assistant receives only OAuth tokens that work at mcp.writavo.com (an access token lasts one hour), never the key. - The local server generates the key on the person's machine and sends Writavo only its hash, so the secret never crosses the network. - A sign-in must be started and approved in the same browser. A sign-in link someone else started cannot connect their assistant to your Site: it is cancelled, and any key it produced is revoked. - Every request is checked against the key's permissions and the approver's live role, on the server. Nothing depends on the assistant behaving well. - Approving, denying, revoking and changing these settings are recorded in the organisation's audit log. > Keys you create by hand and paste into an assistant are ordinary keys: none of the agent controls on this page apply to them. Prefer connecting through the MCP server, which always creates an agent key.