Access & Permissions¶
SchemAlign MCP follows SchemAlign's existing security boundaries instead of creating a separate AI-specific permission model.
Effective access¶
An organization capability is available through MCP only when every applicable authorization layer permits it:
current SchemAlign user access
AND
current organization membership / RBAC
AND
OAuth scope granted to the AI client
AND
organization MCP policy
=
effective MCP capability
A user can remain connected to an AI client while organization access or individual organization capabilities change independently. The next protected MCP request uses the current effective access.
Organization boundaries¶
MCP does not treat Global access as automatic.
Global and customer organizations are evaluated independently. A user may be able to access:
- one customer organization only
- Global only
- multiple authorized organizations
- no organizations
An authenticated MCP connection with no available organizations is valid; it simply has no organization data to expose.
Organization capabilities¶
Administrators independently control the capabilities an organization exposes through MCP.
| Capability | What it permits |
|---|---|
| Projects | List projects in the organization. |
| Pipeline metadata | List pipelines and basic pipeline information. |
| Pipeline definitions | Read sanitized pipeline configuration and node definitions. |
| Pipeline graph | Read a sanitized graph of nodes and edges. |
| Run history | List runs and read one run's status and timing. |
| Artifact metadata | List durable outputs without their contents or storage locations. |
| Exact logs | Read stored log events exactly. This is sensitive diagnostic access. |
| Artifact contents | Read supported text artifact contents. This is sensitive content access. |
| Runtime values | Read persisted runtime-value observations. This is sensitive diagnostic access. |
| Read Extend | Read connectors, versions, source, quality, adoption, runtimes, native bundle metadata, compatibility, accounts, and SchemaDocks. |
| Author Extend | Create and revise drafts, validate, prepare environments, test eligible versions, and publish immutable versions. |
| Manage native runtimes | Create native bundle records and upload explicitly licensed archives with user attestation. |
| Install Extend connectors | Install published versions and approve their declared capabilities and exact native bundle digests. |
| Execute Extend tests | Run version or installed-connector tests through the governed connector runner. |
These controls are additive to normal SchemAlign RBAC and OAuth consent. Enabling an organization capability does not give a user access to an organization or action they cannot otherwise use.
Author Extend must also be enabled for native runtime management, connector installation, and Extend test execution.
Pipeline and Extend boundaries¶
Pipeline access remains read-only. An AI assistant cannot use the current MCP tools to:
- run, save, create, or delete a pipeline
- change node configuration
- create or delete projects
Separately approved Extend capabilities can perform governed connector-development actions. Those permissions do not grant general SchemAlign administration or pipeline mutation.
MCP does not expose native bundle retirement or deletion, binding removal, connector disable or uninstall, organization-policy editing, user management, or account and credential modification.
Sensitive diagnostic access¶
Exact logs, artifact contents, and runtime values are separately gated because they can contain sensitive operational data.
Exact logs are returned as stored rather than sanitized. Depending on what a pipeline recorded, they may contain stack traces, response bodies, authentication headers, tokens, identifiers, or other sensitive values. Organization administrators should enable each sensitive capability only when appropriate.
Sanitized pipeline definitions¶
Pipeline definitions returned through MCP are prepared for inspection and documentation.
SchemAlign does not return credential secret material through the pipeline-definition tool. Configuration may include non-secret references needed to explain how a pipeline is assembled, while protected credential values remain outside the MCP response.
Extend credentials and native software¶
Connector tests accept stored account references instead of raw secret values. MCP does not return account passwords, tokens, private keys, or similar credential material.
Native software uploads require explicit confirmation that the institution is authorized to upload and use the archive. The archive is handled through governed bundle validation and exact-digest approval; MCP does not return archive contents or private storage paths.
Revoking access¶
There are several ways to remove effective MCP access:
- remove the user's organization membership
- change the user's organization role or permissions
- disable MCP or an individual MCP capability for the organization
- revoke the user's AI-client authorization
- disconnect or repair deployment MCP trust
Use the narrowest control that matches the intended outcome.
For deployment-level controls, see Manage MCP Trust.