The governance model
BusinessMCP gates what teammates and external AI agents can see and do. It is backward-compatible: with no policy configured, everything is full access. You tighten it by creating an access policy and assigning it to a member or minting a scoped API key against it.
Roles & policies
Owners and admins are always full access. A member (or a scoped API key) runs under an access policy. On Pro you get toggleable presets — Read-only, No revenue, No PII, Analytics-only, No-send. Enterprise adds fully custom policies (any tool/data-class/can-act combination). Manage these in Settings → Access.
Data classes
A policy grants or withholds sensitive data classes: revenue & financials, analytics & session behaviour, contact PII, company enrichment, CRM/config changes, email/audience sends, code writes, and connected-source reads (Slack, Gmail, Drive, web). Each tool is mapped to the classes it touches, so a policy without revenue blocks revenue tools and scrubs revenue fields from any other tool's output.
Scoped API keys
Mint mcph_* keys against a policy in Settings → Access. Give an external agent (or a partner, or a specific automation) a key that can, say, read analytics but never see revenue or contact emails, and never send. The key's scope is enforced identically on /api/mcp, /api/v1/runs and the CLI.
Actions & approvals
Read tools return data. Side-effecting tools — send email, push audiences, open PRs, CRM writes — are gated by the policy's "can act" flag, and the sensitive ones surface as approvals in the owner's dashboard. External agents can propose an email; a human approves the send. You get agent leverage with human control and a full audit trail (every call is logged with the governing policy).
Frequently asked questions
What happens with no policy configured?
Everything resolves to full access — owners and admins are always full access, and a workspace with no policy set is unrestricted. Governance is opt-in and backward-compatible: you tighten access only when you create a policy.
Is redaction only in the UI?
No. Enforcement is at the tool layer: disallowed tools are never advertised, and every tool result is scrubbed before it reaches the model or an external agent. A field you are not permitted comes back as [redacted] even if the underlying tool returned it.
Keep going
Turn your company into one AI-ready data platform on a single hosted MCP endpoint.