MCP permissions and scopes

knowledge:read covers authorized Project search, source retrieval, artifacts, evidence, Research Threads, health, and activity. research:read remains an accepted legacy alias and grants no extra access.

companies:read, claims:read, drafts:read, posts:read, portfolio:read, and watchlist:read add their named read surfaces. memory:read, email:read, and calendar:read are privacy-sensitive. They are excluded from defaults and future-read auto-grants and must be explicitly selected or re-consented.

drafts:write creates and revises private Writing Studio work. library:write creates Project content and inputs; library:edit revises allowed Project text or metadata; library:manage handles folder lifecycle. email:manage organizes inbound Prism Email. thesis:propose creates review-only thesis material, and graph:write manages explicit relationships.

portfolio:write, watchlist:write, calendar:write, threads:write, threads:run, and memory:write each unlock only their named Prism workflows. A scope does not override a tool's own confirmation, expected-version, Project restriction, or human-review requirement.

Write scopes are never granted automatically. Deployments can set PRISM_MCP_WRITE_TOOLS_ENABLED=false as an emergency kill switch; leaving it unset does not hide authorized writes.

For new, edited, or re-consented connections, a selected Project includes its current and future descendants. Existing unedited connections retain their legacy exact-folder grants until they are edited or re-consented.

For a shared Project, Prism intersects the connection scope, the selected Project, current membership, and the owner's AI grant on every call. Shared access cannot use destructive actions, generic action gateways, personal Email or memory, portfolio changes, publishing, monitor configuration, or human-only approval decisions.