Introduction
This guide is for ComplyFlow administrators. It explains who can connect an AI assistant to your ComplyFlow account, how to give or remove that access, and how permissions limit what an assistant can do.
Who can connect an AI assistant
A staff member can create Personal API Tokens and connect AI apps if either of these is true:
They have the MCP / API token access permission, or
They have Edit Organisation Details (Organisation read and write).
They must also be active.
Staff who already had API access before this feature was released were given MCP / API token access automatically.
Give or remove access
1. Go to Staff, open the staff member and select Permissions. Switch the permissions panel to Advanced; the setting isn't shown in the simpler view.
2. Open the Organisation section.
3. Under API / MCP Access, tick or untick MCP / API token access.
4. Save the permissions.
Only the account owner, or staff with Staff read and write, can change this setting.
What happens when you remove access
API Tokens disappears from their menu, and they can't create tokens or connect apps.
Their Personal API Tokens stop working straight away. If you give access back, their existing tokens work again.
Their connected apps stop working straight away. If you give access back, they may need to connect their apps again.
Edit Organisation Details also gives access. Unticking MCP / API token access doesn't stop someone who also has Edit Organisation Details (Organisation read and write). To stop them, remove that permission too, or deactivate them.
What happens when someone is deactivated
All their tokens and connected apps in your organisation are revoked immediately. If they're reactivated later, they need to create new tokens and connect their apps again.
How permissions limit an assistant
Every request from an AI assistant is checked twice:
Check | What it is | Where it's set |
What the token or connection allows | The scopes ticked when the token was created, or when the app was connected. For example Incidents (read) or Workers (write) | By the staff member, when they create the token or connect the app |
What the person is allowed to do | Their own module permissions and site access in ComplyFlow | By you, in Staff permissions |
Both must allow it. A scope never gives someone more than their own permissions. For example:
A staff member with read-only access to Workers can't use Workers (write). It's greyed out when they create a token, and refused if they try.
A staff member limited to two sites only sees and changes data for those two sites through their assistant.
If you remove someone's Incident permission, their assistant can't read incidents any more, even with an Incidents scope ticked.
The account owner passes the permission check for every module, but still only gets the scopes they tick.
Recommendations
Give access to the people who need it. Start with a small group, such as WHS managers and administrators.
Encourage read-only first. Suggest staff create read-only tokens, or untick the write items when connecting an app, until they're comfortable.
Keep token lifetimes short. 30 or 90 days is plenty for most people.
Review access when roles change. Removing MCP / API token access (and Edit Organisation Details, if they have it) is the quickest way to stop someone's AI assistants.
What administrators can't see yet
Each staff member manages their own tokens and connected apps, and you can't currently view or disconnect another person's. To stop someone's access, remove their MCP / API token access permission and, if they have it, Edit Organisation Details. Or deactivate them.
Related guides
Refer to Connecting AI assistants to ComplyFlow: overview
Refer to Creating and managing Personal API Tokens
Refer to Signing in with an AI app or using a Personal API Token
Refer to Making changes in ComplyFlow with an AI assistant