Control Who May Connect¶
Info
New in Atfinity 17.
Two settings decide whether a tool may create its own OAuth client for your tenant, and the installation-wide one wins.
Your tenant setting, "Allow MCP clients to register themselves", sits under Integrations in AI, on the Settings tab. It is off until you turn it on, so until then a tool needs credentials an administrator created for it.
The installation-wide setting has three states.
| State | What it means for a tenant |
|---|---|
| Off | No tenant may let tools register themselves, whatever its own setting says |
| Per tenant | Each tenant decides for itself |
| On for all tenants | Every tenant allows it, whatever its own setting says |
Turning self-registration off only stops new clients appearing. A client that registered earlier keeps working, and access anyone already granted stays granted.
Letting Atfinity Intelligence use the tools¶
Atfinity Intelligence can use tools of its own from a conversation, in the configuration and in a case, and each area has its own pair of settings under Integrations in AI, on the Settings tab, grouped under Atfinity Intelligence:
| Setting | What it decides |
|---|---|
| In the configuration | Whether a configuration conversation may use the configuration tools at all |
| May change the configuration | Whether such a conversation may write, or only read |
| In cases | Whether a case conversation may use the case tools at all |
| May change cases | Whether such a conversation may write, or only read |
Both areas are off until you turn them on, and both allow changes once you do. Turning the change setting off caps every conversation at reading, whatever the user picked, which is the setting to reach for where only a person should edit. Case changes take effect immediately rather than landing in a draft, so that distinction matters more for cases than for the configuration.
An installation can also switch any of the four off for every tenant at once, which whoever runs it does through the deployment rather than in Atfinity.
Seeing what has access¶
The OAuth Clients tab under API lists every client for the tenant, with what each may currently do and whether an administrator created it or it registered itself.
A client reads as having no access both before anyone grants it anything and after its access has lapsed for good, which is the signal that revoking it would change nothing.
Ending access you have granted¶
Revoking a client ends its access immediately and cannot be undone. Every token it holds stops working, including the renewal that would otherwise have carried it another thirty days.