# Workspaces and permissions

Choose which workspaces your AI agent can use, see what each role allows, and add, revoke or disconnect access.

Your AI agent works only in the workspaces you authorize, and only with the role you have in each of them. Your agency profile is the one exception: it belongs to your account, not to a workspace. This page explains how your agent chooses a workspace, what each role allows, and how to change or remove its access.

## One connection, several workspaces

When you connect Claude or ChatGPT, a Contenttosocial page asks you to sign in and choose the workspaces your agent may use. One connection can cover several workspaces, for example one per client. Only workspaces with an active paid plan are listed.

You can also connect with no workspace, with or without a plan. Your agent then works only on your agency profile in the SEO agency ranking, from claiming it to keeping it up to date, with the images you upload for it ([Agency profile](https://contenttosocial.com/docs/assistant-actions#docs-agency-profile)). On the **MCP** page, the connection reads **Your agency profile and image uploads, no workspace**. You add workspaces later with **Manage access**, without reconnecting.

Apart from your agency profile, your agent sees nothing outside the workspaces you selected. A workspace you create or join later is never added automatically.

## Choose the workspace for each request

Your agent first calls `list_workspaces`. It returns the workspaces your agent can use right now, with your role in each (Manager appears as `editor`) and each workspace’s timezone. Your agent then names the workspace in every action, so one conversation can work for several clients without mixing them up.

- When you have several workspaces, name the one you mean: “In the Northwind workspace, list next week’s posts.”
- If the workspace is unclear, your agent should ask you before changing anything.
- If you selected exactly one workspace when you connected, a request that names no workspace goes to it. If it is later removed from the connection, such requests are refused, never sent to another workspace.

## What each role can do

Your agent has your current role in each workspace, checked on every request: a role change applies at once. Manager is the role that schedules and publishes.

| Role        | With your agent                                                                                                                                                                                                                                                       |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Contributor | Reads templates, the brand kit, posts, social accounts and reviews; renders previews; creates, edits and deletes drafts and library images. Cannot schedule or publish, add or change templates, change the brand kit or answer reviews.                              |
| Manager     | Everything a Contributor does, plus: copies starter templates and collections, creates and edits templates, changes the brand kit; schedules, publishes, moves, cancels and retries posts; submits posts for client approval, comments, approves or requests changes. |
| Admin       | Everything a Manager does, plus: lists the workspace’s client accesses and sets what clients may change in their client space. In the app, Admins also manage the team, social accounts and client access.                                                            |
| Owner       | Everything an Admin does, plus the event destination. Billing stays in the app, for the Owner only.                                                                                                                                                                   |

[What your agent can do](https://contenttosocial.com/docs/assistant-actions) gives the role each tool needs.

## Plans

- Your agent works only in workspaces with an active paid plan. If a plan ends, the workspace leaves your agent’s list and its requests there are refused with a link to the plans. The authorization is kept: access returns as soon as the plan is active again.
- Client approval needs the Freelance & Agencies plan: submitting posts, commenting, approving or requesting changes, and reading or setting what clients may change.
- If you are a team member rather than the workspace’s Owner, the Owner’s plan needs a colleague seat for you, on any plan. Without one, the workspace does not appear in your agent’s list.
- Your agency profile and its image uploads need no plan.

## Add or remove workspaces

You can change the workspaces of a connection without reconnecting:

1. In Contenttosocial, open the account menu from your name (or **My account**) at the bottom of the sidebar, then choose **MCP**.
2. Under **Your MCP connections**, choose **Manage access** on the connection.
3. Select or clear workspaces, then choose **Save**.

Workspaces without an active paid plan cannot be added: they show **Paid workspace access required**. Once a connection has workspaces, **Manage access** keeps at least one: to stop all access, disconnect instead. On the connection, **Access removed** or **Access unavailable** next to a workspace means your agent cannot use it: the workspace was removed from the connection, or it has no active plan, or you no longer have a role there.

If you reconnect from your agent instead, you choose the workspaces again and the new selection replaces the previous one.

## Disconnect

On the **MCP** page, choose **Disconnect** on the connection, then confirm. The connection stops at once, in every workspace and for your agency profile alike, and moves to **MCP connection history**. To use your agent again, connect it again from Claude or ChatGPT, sign in and approve access.

If the connection shows **Finish disconnecting**, access is already blocked: choose it to complete the disconnection.

Disconnecting does not cancel posts already scheduled. They stay in the calendar until you cancel them.

## Team members’ connections

On a workspace’s **Team** page, the Owner and Admins find **MCP connections**: the agent connections teammates authorized for that workspace, with the teammate who authorized each one. **Revoke workspace access** removes a connection’s access to this workspace only; the teammate’s other workspaces are not affected. The list leaves out your own connections and the Owner’s, so Admins cannot revoke the Owner’s access.

While they remain on the team, the teammate can add the workspace back with **Manage access**. Everyone manages their own connections from the account menu, on the **MCP** page.

## When someone leaves a team

Removing a member from a workspace also removes their agent’s access to that workspace, and only that one. Joining the team again does not restore it: they add the workspace back with **Manage access**. Posts they already scheduled keep publishing unless someone cancels them.

## What your agent can never access

Your agent cannot:

- change billing or the plan, or see payment details (`get_workspace` shows the plan’s name, limits and usage);
- see or change team members, invitations and roles;
- connect or disconnect social accounts, or see their sign-in details (`list_accounts` shows the connected accounts and whether they need reconnecting);
- invite clients, give, change or remove their access, or send them emails (Admins can list client accesses and set what clients may change);
- change workspace settings such as the name or timezone (it can read them);
- create, delete or transfer workspaces;
- reach workspaces you did not select, or where you no longer have a role;
- see your Contenttosocial password: you sign in on Contenttosocial’s own page, never in the conversation.

All of this stays in the Contenttosocial app.