On the MCP consent screen, choose Read only when the assistant needs to inspect information without receiving write capabilities. Review the selected permissions and company before approving.
The screen also offers Full access, Clear optional access, Select all read, and Select all write. These are selection controls, so inspect the resulting capability list and selection count rather than relying only on the preset name.
Some write permissions require related read permissions and enable those dependencies. If you choose a write capability after selecting Read only, the final selection is no longer a purely read-only grant.
Allow selected access only when the displayed set matches the task. You can later reduce permissions in the portal, while adding permissions requires another consent flow. Read-only consent still applies within your current Institution role and chosen company; it does not expose other users’ chats, internal notes, or service credentials. If a requested answer needs a capability you intentionally excluded, the agent should explain the limitation instead of assuming broader access.
Was this article helpful?
Tell us whether this answered the question you came with.