> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exec.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin Controls

> What you can govern about MCP connections today, and where each control lives.

**Most of the control lives on the AI assistant's side, not in Exec.** Exec has no MCP settings page today, so this page covers what you can and cannot govern, and where each control actually lives.

***

## What you control, and where

| Control                                          | Where                                                          | Available                                                  |
| :----------------------------------------------- | :------------------------------------------------------------- | :--------------------------------------------------------- |
| Whether Exec can be connected at all             | Your AI tool's organization or admin settings                  | Yes, if you are on a team or enterprise plan for that tool |
| Which of your people can connect                 | Same place, by controlling who is in that organization         | Yes                                                        |
| What any connected person can see                | Exec, through their normal role and group membership           | Yes, and it is automatic                                   |
| Cutting off one person's access                  | Exec, by deactivating them or removing them from the workspace | Yes, takes effect on their next request                    |
| Seeing a list of who has connected               | Not available in Exec today                                    | No                                                         |
| Disconnecting a specific person from inside Exec | Not available in Exec today                                    | No                                                         |
| Restricting which capabilities are available     | Not available per workspace                                    | No                                                         |

***

## The control that matters most is the one you already use

Because a connection carries exactly the permissions of the person who made it, **your existing roles and groups are the access control.** You do not need a separate policy for AI assistants to decide who can see what. A rep who connects sees their own practice because that is what a rep sees.

And for offboarding, the answer is the one you would do anyway: deactivate the person in Exec, or remove them from the workspace, and their connection stops working on its next request. Nobody has to go into their AI assistant.

So the two things worth doing before a wide rollout are ordinary Exec hygiene:

* **Check your group structure.** Group admins see their groups through the connection, so if groups are wrong, visibility is wrong.
* **Check who has admin.** Workspace admins see the whole workspace, including all analytics, through the connection.

***

## Approving Exec once, for your organization

If your company is on a team or enterprise plan for your AI tool, connectors usually have to be approved centrally before anyone can use them. That approval is your main gate.

An owner on that side adds Exec once, using `https://api.exec.com/mcp`, after which each person connects their own account. Approving the connector does not grant anyone access to any data. See [Connect your AI tool](/mcp/connect).

Turning that approval off later blocks new connections, and depending on the assistant may block existing ones too. Your assistant's own documentation is the authority there.

***

## What to tell your team when you roll this out

Three things are worth saying explicitly, because they are the ones that cause surprises:

1. **Scenarios published through an assistant are shared with the whole workspace.** See [What the AI can see](/mcp/what-the-ai-can-see).
2. **It answers the question you asked.** Point people at [Prompts and reliable answers](/mcp/prompts-and-answers) before they start quoting numbers in reviews.
3. **An assistant with several tools connected can carry Exec data into the others.** If you have policies about where performance data may go, say that they cover AI assistants too.

***

## FAQs

<AccordionGroup>
  <Accordion title="Can I see which of my people have connected?">
    Not from Exec today. There is no MCP screen in the product. If your company approves connectors centrally in your AI tool, that side may show connection status.
  </Accordion>

  <Accordion title="Can I stop one person using it without deactivating their Exec account?">
    Not from inside Exec. They can disconnect it themselves in their assistant, and an owner on your AI assistant's organization can remove the connector for everyone. Deactivating the person in Exec cuts access immediately but also removes their access to Exec generally.
  </Accordion>

  <Accordion title="Can I turn MCP off for my whole workspace?">
    Not as an Exec setting. The effective control is to not approve Exec as a connector in your AI tool's organization settings, which prevents your people from connecting it there.
  </Accordion>

  <Accordion title="Can I limit it to reading, with no scenario creation?">
    Not per workspace. Creating a roleplay is the only change it can make, it always shows a draft for approval first, and it cannot delete or edit anything. Some assistants let an individual block specific capabilities on their own connection.
  </Accordion>

  <Accordion title="Is there an audit log of what people asked?">
    Not in Exec. Activity performed through the connection appears the way the same activity would if done in the product, so a scenario created this way is attributed to the person who created it.
  </Accordion>
</AccordionGroup>

***

## Next

<CardGroup cols={2}>
  <Card title="What the AI can see" href="/mcp/what-the-ai-can-see">
    The full permission model
  </Card>

  <Card title="Available tools" href="/mcp/available-tools">
    Everything it can do, listed
  </Card>
</CardGroup>