# Permissions

The reach of a connection is its scope intersected with its owner's current access. It is recomputed on every request. `list_accounts` returns the accounts a connection can reach, with an identifier, a name and import freshness. Read-only tools are available to every connection; administrative tools are visible only to administrators. Connections are reviewed on the connections page. Choose accounts at sign-in; see [connect](</connect.md#choose-accounts>). Only one tool changes data on a member's behalf, `save_scenario`, and only when all of these hold on the request: the connection or key is allowed to change data, the owner has turned on Agents may change data for them on that account, the owner may use the Model Calculator (administrator, or Agency Model use), and the account is one the connection reaches. A saved scenario belongs to the person who owns the connection, so only they or an administrator can change it later. The scenario tools (`list_scenarios`, `get_scenario`, `save_scenario`) and the `scenarioId` option of `get_capacity_plan` and `get_agi_report` need the same Model Calculator access. `list_payroll_entries`, `list_changes` and `get_change_batch` require People grid view on the account, or an administrator. Whatever a connection changes is recorded in the account's change log with the client name, the person whose credentials connected it and the optional `reason` it gave, and is visible to the account's people. Administrative tools need an administrator's opted-in connection, and API keys never grant them.

Live documentation resources and `search_docs` require authentication but no account selection or reachable account. All live pages are available regardless of their editorial audience tags. Preview and internal documentation is listed, readable and searchable only on an administrator's OAuth connection opted in to administrative tools. An administrator's ordinary OAuth connection and every API key see only live pages. This documentation access does not change account access checks on other tools.

## Compensation and person-level data

Per-person compensation, cost per delivery hour by person and payroll rows are served to an assistant only when the connection owner has People (payroll) grid view on that account. Nobody without payroll grid access sees them through any tool. The check uses the owner's own membership on the account, read on every request; an owner with no membership on the account gets nothing. Administrator status adds no reach here, so an administrator's connection sees what their own membership row allows.

Aggregates stay available without People view, as the app shows that member: account-level totals inside the planned reports, hours, capacity and utilization. Where a tool holds a compensation-derived field, it omits the field and returns a `compensation-withheld` caveat rather than a zero or a blank. Today that is cost per delivery hour in `get_saved_estimate`, Direct Delivery Margin in `estimate_project` and payroll rows in `get_scenario` (with `includeRows`). Missing-row names and dates are also withheld without People grid view, even when `includeRows` is false; `missingRows` is then empty and a `rows-withheld` caveat explains why.

The grid listings `list_project_entries` and `list_expense_entries` need at least view access to that grid, and `get_agi_report` and `get_finance_forecast` need view access to the Projects grid, matching the app. `list_payroll_entries` is unchanged: it needs an administrator or Payroll Grid or Model Calculator access and returns no compensation.