Choose agent permissions
Choose permissions on the browser authorization page. The setup card copies connection instructions; it does not select permissions or authorize a connection.
Choose a mode
| Mode | Starting access |
|---|---|
| Default | Read and search, add and update content, delete content, create drives, and rename drives. Drive deletion and sandbox access stay off. |
| Custom | Keep the current selection, then choose individual workspaces, drives, and actions. |
| Read Only | Read files and search, without changes. |
| Full Access | All available actions, including deleting drives and giving sandboxes drive access. |
Every mode respects your workspace role. A viewer remains limited to reading and search, including under Full Access. Presets use the workspaces currently available to you and select all drives in those workspaces.
A manual change switches the selection to Custom. Changing controls back does not automatically select another mode. Selecting Default, Read Only, or Full Access replaces the current selection and clears the confirmation, so review it again.
Approve only the access you need
For a reading task, use Read Only or choose Custom to narrow access to particular drives. An all-drives selection also covers new drives that later fall within that grant. Select individual drives when the task needs a narrower boundary. Folders organize content inside a drive; they do not restrict access.
A mode is a selection, not approval. Review the account, workspaces, drives, and actions, confirm the selection, then choose Allow. Cancel if the requested access is wrong. If permission choices cannot load, retry before approving.
Change or revoke a connection
Open MCP connections to review an existing connection. Edit its access or revoke it. Your current workspace role remains an upper limit on what the connection can do.