Skip to main content

Permissions & scopes

DocJacket's MCP server exposes 157 tools across three scope tiers, and supports per-tool toggles inside the AI client. All three tiers are live. You choose one when you consent, and it is enforced at the token — a read-only connection cannot call a write tool even if the assistant tries.

The three scopes​

ScopeWhat it coversApproval flow
read (73 tools)Search, lookup, list — e.g. search_transactions, get_upcoming_key_dates, get_next_required_actions, get_open_tasks, get_deal_section, diagnose_deal. With read, an assistant can also read a deal's internal notes and the comments on its tasks and documents, its email including message bodies, its text-message threads, scheduled sends, consistency checks, change log, key-date history, agreements, and TC fees and invoices (no payment links). It can see each task's settings, including whether the task shows on the SitRep report and on the client portal. Nothing here changes a record or contacts anyone.Auto-approved per conversation in most clients
draft (32 tools)Low-risk writes to your own records — create_tasks, complete_task, set_task_outcome (complete, skip or reopen up to 25 tasks), update_task, update_key_date, manage_key_date, manage_note (internal notes and comments), apply_checklist, log_activity, save_status_summary. Tools in this tier can't write or send an email themselves. Some run the same steps as DocJacket's own buttons, though: marking a task done starts the follow-up emails linked to it, and moving a date can make a scheduled email go out sooner. If your team reviews outgoing email first, which is the default, those emails wait in your Review queue until someone approves them.DocJacket marks these as write tools; the assistant asks first if its approval setting for the tool is on
actions (52 tools)Side-effecting work — sending email (send_client_update, send_document_request, send_agent_followup, send_email_to_agent), changing a deal's own details (update_deal), changing who is on a deal (manage_deal_contact), deleting tasks (delete_tasks), restoring an archived deal (restore_deal), creating and deleting records, and disclosure packages that expose documents outside the org.DocJacket marks these as write tools; the assistant asks first if its approval setting for the tool is on

The draft tier is the useful middle setting: an assistant can keep your tasks and deadlines current without being able to write or send an email of its own. Browse all 157 tools → to see exactly what sits in each tier.

The conversation is the approval gate​

For both write tiers, supported MCP clients use a confirm-then-execute UX:

  1. You ask the assistant to do something.
  2. The assistant proposes the action in chat — what tool, what arguments, against what data.
  3. You confirm or redirect.
  4. The assistant fires the tool only after you say yes.

For most external AI Access writes, DocJacket's server does not run a second approval queue. We retired the old sidebar "Pending Review" page in May 2026 — the scope you grant and the assistant's own per-tool approval settings gate those writes. Email is the exception, and works as follows. This is separate from the in-app Review queue, which still handles DocJacket automation drafts, scheduled sends, recent activity, and pending uploads.

Email an assistant writes​

Every email an assistant writes is first placed in your Review queue. What happens next depends on your organization's review setting:

  • If your organization reviews outgoing email, or something about the email requires a review, it stays in the Review queue until a team member approves it in DocJacket.
  • If review is off and nothing requires it, the assistant gets a preview of the exact email and a one-time confirm code that is good for 30 minutes. It shows you the preview, and the email goes out only after you say yes.
  • After you say yes, the email is queued, not yet sent. Whether it went out arrives afterwards as an email.sent or email.failed webhook event for anyone listening.
  • Who it can email. An assistant can email the contacts on the deal and the active members of your own organization. An email to anyone else stays in the Review queue.
  • Held emails. An assistant can list and read the emails held in your Review queue, and discard one. It can approve and release a held email only in an organization that has that turned on; elsewhere, a team member approves it in DocJacket.

Read the retirement spec for the full rationale.

Per-tool toggles (client-side)​

Beyond the three scopes, every AI client lets you toggle individual tools off:

  • Claude.ai / Claude Desktop: Settings → Connectors → DocJacket → click any tool to toggle. Tools default to Needs approval for the first call; you can switch to auto-allow per-tool.
  • ChatGPT: Settings → Connectors → DocJacket → toggle individual tools. Same approval-first default.
  • Codex CLI: Configure per-tool overrides in ~/.codex/connectors.json or use codex policy to set defaults.

DocJacket enforces the scope tier at the server. The per-tool toggle is enforced by the AI client. Both have to allow a tool for it to run.

Read-only by default​

The safest pattern — and what we recommend for first-time users — is to consent to read only at the DocJacket consent screen. Your assistant can search, look up, and summarize without ever being able to send an email or create a task.

read is not limited to lookups. It lets the assistant read a deal's internal notes, the full text of its emails, and its text-message threads, so grant it only to an assistant you are comfortable seeing that content. It can also read the comments on a deal's tasks and documents, and see which tasks are shown on the client portal. It can't change any of it. A member whose role is limited to their own deals can't connect an assistant at all (see Understanding Roles).

If your account has draft or action scopes enabled later, you can re-consent or mint a new token with those scopes. You can revoke access any time.

Audit log​

Every MCP tool call lands in your Activity Log within seconds:

  • DocJacket → Settings → API & AI Access → Activity Log

Each row shows:

  • The connected client (Claude / ChatGPT / Codex / Cowork / Gemini)
  • The user who triggered it (you, or any other user in your org)
  • The tool name (search_transactions, get_transaction, etc.)
  • The arguments passed
  • The outcome (success / error)
  • Latency in milliseconds
  • A timestamp

Filter by client to see what one AI surface has been doing. Filter by tool to spot unusual activity. The log is per-organization and immutable.

Revoking​

Settings → API & AI Access → Connected Clients (for OAuth) or Personal Access Tokens (for bearer).

Click Revoke on any row. The next tool call from that client returns HTTP 401. The user will either fall back to re-consent (if they want to reconnect) or fail gracefully.

There's no propagation delay. Revocation lands on the next request.

What an assistant can set up​

When the setup assistant is turned on for your organization and the person who connected it is allowed to edit organization settings, a connected assistant can change some of your organization's setup: your Primary State, your default TC fee, a client agent's fee or coordinator, your contact roles, your document categories, and your email templates. A Primary State or fee change made this way takes effect right away and can be undone for 7 days. Archiving a role or category hides it and never deletes it; deals that already use it keep it.

What an assistant cannot do​

Even with actions scope granted and a tool toggled on, an assistant cannot:

  • See data from a different organization than the one you consented for
  • Change your billing plan, seats or user permissions, or organization settings other than the setup items listed above
  • Read other Connectors you've enabled on the assistant (e.g., your Gmail content)
  • Bypass DocJacket's role-based access (e.g., if you're an org member without Admin rights, the AI inherits your access — not your owner's)

Tenant isolation is enforced at the SQL layer. Every MCP tool call adds WHERE OrganizationId = @TokenOrg to the underlying query. The AI cannot supply the org ID — it comes from the token.

Read more​