# Capabilities & Security (https://yapl.app/en/docs/user-guides/ai-agents/capabilities-and-security)

# Capabilities & Security

The connector is built on one invariant: **your agent sees what you see, and acts as you.** Every read and write runs under your own account with your workspace roles and row-level permissions — an agent can never surface data or perform an action your own login couldn't.

## How Access Works

- **Standard OAuth sign-in.** Connecting an agent runs an OAuth 2.1 authorization: you sign in to YAPL in your own browser and explicitly approve the client. The agent never sees your password.
- **Short-lived tokens.** Clients receive expiring tokens tied to your approval — not permanent keys. Revoking the client cuts access immediately.
- **Per-client approval.** Each agent client registers and is approved individually. Connecting Claude Desktop doesn't grant anything to another tool; every client shows as its own card under **Settings > Integrations > MCP Connectors**.
- **Any-client, same rules.** Because registration is open (the MCP standard's dynamic client registration), any MCP-compatible agent can request access — but *request* is all it can do until you personally sign in and approve it. Unknown clients never gain silent access.

## What Agents Can Do

Everything in [the overview's capability groups](/docs/user-guides/ai-agents/index) — reading plans and metrics, editing the open draft, tracking progress and actuals, booking resources, navigating your tab — always bounded by your own permissions in each workspace.

## What Agents Can Never Do

These are not exposed to agents at all, for any client, regardless of your role:

- Change your account, email, or password
- Manage billing or subscriptions
- Add, remove, or change roles of workspace members and teams
- Delete plans, projects, or workspaces

They're not "asked about" or "confirmed" — the tools simply don't exist on the connector.

## Guardrails Around Editing

- **Draft-first structure editing.** Structural changes land in an unpublished draft in your open tab. The published plan changes only when you publish.
- **Publishing is deliberate.** The agent publishes only when you tell it to, and if the live plan changed underneath your draft, the normal review/conflict dialog takes over — the agent stops and asks rather than resolving conflicts itself.
- **The plan must be on screen for edits.** If your tab has navigated elsewhere, draft edits are refused until the plan is back on screen — so nothing changes in a plan you aren't looking at. Reads are always allowed.
- **Same validation as the app.** Cycles in dependencies, task limits, hierarchy rules — an agent is refused exactly where you would be, with the same messages.

## Plan Features and Tiers

The MCP Connector for AI Agents is a **Professional and Trial** feature. The check runs on **every tool call** against the workspace's current plan — not just when you connect — so:

- On a Basic workspace, agents are refused on every tool, with a message naming the plan and the upgrade path.
- If a workspace downgrades from Professional, or its trial expires, agents that were authorized earlier stop working immediately. No re-authorization trickery can bypass this; upgrading restores access without reconnecting.
- Within an eligible workspace, individual tools still mirror plan features — for example, cost and earned-value tools additionally require a tier with cost tracking.

## Revoking Access

**Settings > Integrations > MCP Connectors** lists every client you've approved with its connection time and client ID. **Revoke** disconnects a client immediately and independently of the others. If you suspect anything odd, revoke first and reconnect later — reconnecting takes a minute.