Where a permission comes from
An agent host asks for a list of permissions when it starts the sign-in flow. Coffee Chats checks that list before it shows you anything, and an ask for a permission that is not grantable never reaches a sign-in page. After you sign in, the Authorize access page shows the list it asked for, one line per permission, each with the sentence that says what the permission covers. Those sentences are the product’s own wording. The permissions reference is generated from the same source as that page, so the wording on it is the wording you will read. The connection receives the permissions you approved and nothing else. Approving a wide list does not widen the tools; it only widens which of the 85 tools the connection may call.Twenty-two permissions you can grant
Twenty-one of them control tools. The twenty-second,offline_access, controls nothing but the life of the connection.
offline_access is not a permission to read anything. It lets the agent host keep the connection alive with rotating refresh credentials instead of sending you back through sign-in. Without it, the agent’s access stops after ten minutes and you sign in again. No tool requires it.
The permissions reference lists all twenty-two with the consent sentence and the tools each one unlocks.
What a missing permission does
A tool whose permission was not granted does not return your data. It returns the fixed failure text,Tool call failed., with no code and no reason.
That silence is deliberate. A message saying “you did not grant contacts:read” would itself be a statement about your account, so the connector says only that the call failed. An agent that reads a reason into that text is guessing. Two failures say more, and each arrives only after the permission was granted. A lookup of a record your account does not have names the kind of record it did not find, and a meeting whose transcript Coffee Chats does not hold says that. Failures that carry no code has all three texts.
Read the tool list, not the sentence
A consent sentence is short, and a short sentence is always a little wider than the thing it describes. The last column of the permissions reference lists the tools that use each permission, generated from the catalogue the connector registers. If a consent sentence ever sounds wider than that list, believe the list.Permissions and the tools that need your approval
Nine tools need your approval as well as a permission. The permission lets an agent propose the change as a review request. It does not let the agent make it. Safe writes and approvals describes the difference, and approvals describes the page you decide on. Two permissions spend credits.research:run backs only contacts.research.start. A connection made before research was available does not hold it. To let an agent start research, connect the application again and grant research:run on the Authorize access page; nothing else about the connection changes. Proposing research also needs contacts:read, because the proposal shows each contact’s name. Reading research results needs only contacts:read.
documents:generate backs documents.resumes.generate and documents.jobs.tailor, which write a resume or a tailored resume and cover letter and use credits as soon as the agent calls them, with no approval page. Both also need documents:read. Your resumes and cover letters have their own permissions: documents:read reads them, with their text and download links that work for 15 minutes, and documents:write edits a section of one, for free. jobs:read and jobs:write reach no resume or cover letter, and neither jobs:write nor documents:write spends credits. A connection made before these tools were available must connect again to grant documents:read, documents:write and documents:generate.
A withdrawal passes two separate gates. The catalogue requires profile:write on every call to actions.cancel, whatever the withdrawal is about, so a connection holding only booking:write can propose an event type change and cannot withdraw it. At the moment of the call, the connection must also still hold the scopes the creating tool recorded on the review request, so a connection that has lost a permission cannot withdraw work it could no longer propose.
Next steps
Permissions reference
All twenty-two, with the consent sentence and the tools each unlocks.
Sign-in and credentials
Where the Authorize access page sits in the sign-in flow.