Permissions & Security

The MCP server was built so a connected assistant can never become a way around your existing access in Tenali. This page covers exactly what it can and can't do, and what an IT or security reviewer will want to know.

The Guarantees

• Read-only. Every tool only reads. None of them can create, edit, delete or send anything in Tenali.
• Never more than you can see. Your identity is pinned when you approve the connection and re-resolved on every single request. An assistant sees exactly what you'd see signed into Tenali — no more.
• You choose the permissions. Raw transcripts and organization-wide access are separate choices on the approval screen. Both are preselected, and you can clear either one before you approve.
• Revocable instantly. Revoking takes effect on the assistant's very next request, even if it still holds a valid token.
• Logged. Every tool call is recorded, and organization-wide reads are recorded separately.

What You Approve

When you connect, Tenali shows an approval screen listing what the assistant will be able to read. The optional permissions are ticked by default — untick any you'd rather withhold. The two required permissions below are always granted and can't be unticked.

Meeting summaries — required

• Title, date and time, platform (Zoom, Meet, Teams, and so on) and duration
• Meeting attendees and organizer
• Brief, full summary and key points
• Action items and next steps
• Any custom sections your summary includes — objections, follow-ups, deal notes

Question Intelligence — required

• Frequently asked customer questions across your meetings
• The answer Tenali captured for each one

Knowledge base content — optional

• Your team's docs, FAQs and training sources
• Titles, content and metadata

Raw meeting transcripts & recording playback — optional

• Full, timestamped transcript text
• Recording and video playback links

All meetings across your organization — admins only

• Every team member's meetings, not just yours
• The same summaries, action items and Question Intelligence, organization-wide

This row only appears if you're eligible. It requires both an admin or super-user role and organization-wide access enabled for your workspace.

Organization-Wide Access

Organization-wide access is what makes team-level questions work — "which objections are costing us deals across every rep?" rather than just your own calls.

It is deliberately strict:

• Eligibility is checked before the option is even offered. If you don't qualify, the row doesn't render, and a client that asks for the permission anyway is refused.
• Entitlement is re-verified on every widened request, not just at sign-in. If your role changes or the workspace setting is turned off, access stops immediately.
• A lost entitlement is an error, not a smaller answer. The request returns admin_scope_lost and tells the assistant to retry without organization-wide scope.

Two scope details worth knowing:

• Knowledge base tools never widen. search_knowledge_base, list_sources and get_source_metadata always run at your own visibility, even on an admin connection.
• Semantic summary search covers your workspace's index. For an exhaustive cross-workspace meeting inventory, list_meetings with organization-wide scope is the reliable tool, and the server says so in its own response.

Authentication

Connections use OAuth 2.1. You sign in with your normal Tenali account — no API keys to generate, paste or rotate, and nothing to store in a config file.

Identity is resolved server-side from the connection record on every call, never from the access token's claims alone. That means changes to your account take effect immediately rather than whenever a token happens to expire.

Audit Logging

Every MCP tool call is written to your audit trail. Organization-wide queries are logged separately, as is any cross-owner recording access. Connection creation and revocation are both recorded.

For admins reviewing activity, see Access Controls & Auditability.

Revoke a Connection

1. 1

   Open the AI Assistants tab

   In Tenali, go to Settings → AI Assistants and find Your connections.

2. 2

   Revoke the connection

   Click Revoke on the connection you want to remove. A toast confirms "Connection revoked."

3. 3

   Confirm it's gone

   The connection disappears from the list. The assistant's next request is rejected immediately — no waiting for a token to expire.

Connecting doesn't copy your workspace anywhere — the assistant reads on demand, and revoking removes its ability to read. Your meetings, transcripts and sources stay exactly where they were. Note that revoking stops future requests only: anything the assistant already retrieved may remain in its conversation history, under its own retention policy.

What Happens When Access Changes

Next Guides

• Tenali MCP Server
• Tool Reference
• Connect Claude
• Security & Privacy
• Access Controls & Auditability