Read-only or full access, curated toolset or entire catalog: how an owner's choices and the plan's limits combine to decide what each person gets.

What a person gets on a connector comes down to two independent settings.

An OWNER always gets the connector's default: FULL_ACCESS on the curated toolset, clamped to read-only on the Free plan. The tables below describe what a teammate can be given. On Scale and Enterprise, an owner chooses both settings per teammate, per connector. On other plans, everyone other than an owner gets READ_ONLY on the curated toolset.

Access mode

Mode	Effect
`READ_ONLY`	Filters the exposed set to read-only operations
`FULL_ACCESS`	Exposes reads and writes

Read-only is enforced on the server at both tools/list and execute time, and it blocks writes attempted through <prefix>_raw_operation. A client cannot route around it.

Catalog scope

Setting	Effect
Curated (default)	A hand-picked, high-value toolset for that provider
Full catalog	Every mapped operation the provider exposes, loaded up front

Curated is the better default. A smaller tool list means the model picks the right tool more often. On Scale and Enterprise, an owner can give a teammate the full catalog when they need breadth. Either way, <prefix>_search_tools reaches every operation on demand, on every plan, without switching.

What a given person actually gets

Both settings are resolved per member, per connector, on every request. Three layers apply in order, and the last one can only narrow.

The connector's default

Every connector is provisioned with FULL_ACCESS and the curated toolset. There is no setting to change that default. It is what an OWNER gets.

The owner's decision for a teammate

On Scale and Enterprise, an owner sets both per teammate, per connector, in the workspace Members panel. Admins can manage who reaches a connector, but not its access mode.

Where the owner has not decided, the teammate gets least-privilege READ_ONLY on the curated toolset. That covers every teammate on other plans, and any connector added since the owner last saved the panel. An OWNER never has these decisions applied.

The plan's ceiling

The organization's entitled plan clamps the result. The Free tier exposes neither write operations nor the full catalog.

This layer only ever narrows. A plan can take a capability away, but it can never grant one — a teammate set to READ_ONLY stays read-only on every tier.

The clamp is applied when the tool list is built, not when a call is executed. An operation the caller is not entitled to never appears in tools/list at all, rather than appearing and then failing.

On Scale and Enterprise, keep a teammate on read-only until their agent behaves, then widen.

Access modes & tool catalogs