MCP access levels and send postures
Two settings decide what a connected AI can do. The access level is chosen per connected app or key. The send posture is one org-level setting that governs every key.
Access levels
An organization manager picks the access level on the Spun consent screen when an app connects, or picks a preset when creating a key.
| Access level | What the AI can do | Can it send? |
|---|---|---|
| Read-only analyst | Read conversations, groups, contacts, shared calendar events, alarms, pipeline boards, Contact Circles, the Keep In Touch list and quick replies | No |
| Assistant, no sends | Also organize chats, create and change calendar events, set and dismiss alarms, move contacts between pipeline stages, manage circles and Keep In Touch, create and edit contacts, and draft replies | No |
| Assistant with sends | Also propose and schedule messages, and ask for calendar invitations to be sent | Only through your approval settings |
Start with Read-only analyst and widen it once you have seen how the AI behaves. You can change the level in place later, under Settings, AI Assistant (MCP), Connected AI apps, or disconnect the app there. An org manager can also narrow any connected app to the Support, Sales or Reporting preset or to chosen permission groups. The scopes page lists every permission.
Calendar events and alarms joined the three levels on 10 November 2026. An app connected before that keeps exactly what it was approved for: nothing is added by itself. An organization manager opens Settings, AI Assistant (MCP), Connected AI apps and presses Review and update access on the app; the review lists in plain words what would be added, and nothing changes until the manager confirms. An alarm set by the AI reminds your team and never messages the customer. Calendar invitations, and telling attendees that an event was cancelled, are WhatsApp messages: only Assistant with sends can ask for them, and they go out only after a person approves the request in AI Sends.
The pipeline, Contact Circles, Keep In Touch, quick replies and contact tools joined the levels on 10 November 2026 too. All three levels read boards, circles, the Keep In Touch list and quick replies. The two Assistant levels also move contacts between pipeline stages, manage circles, put contacts on a Keep In Touch cadence, and create and edit contacts. The same rule holds: an app connected earlier gains nothing until an organization manager presses Review and update access and confirms. Plan rules are unchanged, so on the Free plan a connection at any level still cannot move a stage. Deleting a circle is always a request that a person approves. The tools and their refusals are listed in Pipeline, Circles, reminders and the contact timeline.
The reminder line at the top of Spun. When a connected app is behind its access level and a review would turn on something that app can actually use, administrators see one line at the top of the inbox, for example "Claude can do more after an access review: read calendar, read alarms." With several apps waiting it counts them instead. Review access opens Connected AI apps with that app's review already open, or, with several apps, scrolls to the first one waiting. The line changes nothing by itself: access changes only when you confirm with Update access. The X hides it in that browser until a newer access level exists. It never shows above a WhatsApp connection problem or another warning, or while presenting, and only administrators see it. A ChatGPT connection is counted only when the update opens a tool ChatGPT can use.
The AI app says the same thing in its answers. Asked what it can do, or refused because a permission is missing, it names what is available on its access level but not turned on yet, and tells you that an administrator turns it on in Spun under Settings, AI Assistant (MCP), Connected AI apps, Review and update access.
Moving a card sends nothing by itself, but your own stage rules can send a WhatsApp message or an email, or start a coaching series, when a contact enters a stage. Assistant, no sends is refused such a move, and it is refused a Keep In Touch label that would start a coaching series: the tool answers missing_scope and nothing changes, so this level still never causes a message. Assistant with sends can make the move, and your stage rules then run exactly as they do when a person moves the card in Spun.
The consent screen never grants autonomous sending. If your org wants that, an org manager enables it for the connected app afterwards under Connected AI apps in Spun settings, and re-consenting resets it.
You decide how much rope the AI gets
One org-level setting governs every key. Changing it invalidates anything still waiting for approval.
Drafts only (draft_only)
Most conservative
Every AI send becomes a durable draft in your team inbox. Humans send, edit or discard it - an edited draft goes out as a human-authored message, with the AI original kept as provenance.
Submit → approve (two_step)
Default
The AI submits; the send waits in the "AI sends" queue. A teammate with send permission approves, and the server executes it with fresh checks - channel state, quotas, and whether the customer replied since the draft was written. Unapproved items expire in about 24 hours.
Autonomous (autonomous)
Opt-in, org-wide warning
Sends execute immediately - only when the org posture is autonomous AND the key holds the special mcp_autonomous_send grant. Quiet hours, quotas, the velocity tripwire and the kill switch still apply.
Quiet hours apply on top of every posture: outside your org's window, sends are held (or denied - your choice) and released with fresh checks when the window ends.
AI drafts. Your team approves. The server sends.
- 1. AI submits: The assistant proposes a send with its stated reason - clearly labeled as unverified agent text.
- 2. Human approves: The card shows the real channel, recipient, content and warnings, right in the team inbox.
- 3. Server executes: Approval re-runs every check - channel state, quotas, quiet hours - then delivers through the normal path.
Approval cards are generated by the server from what will actually happen - sender channel, recipient, real content, schedule - never from the agent's own description of itself. If the customer replied while the send was waiting, the approver sees the new message before deciding. Before a send reaches the card, the server also screens it for signs of prompt injection and data exfiltration and shows what it found; in autonomous mode a flagged send is moved to the approval queue instead of going out.