> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coffeechats.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent permissions

> What a permission is, how the Authorize access page grants one, what happens when a permission is missing, and why the tool list is the honest answer.

A permission is one named thing you allow a connection to do. After reading this page you will know how permissions are asked for and granted, what a connection can do with one, what it cannot do without one, and where to read the exact wording of each.

## Where a permission comes from

An agent host asks for a list of permissions when it starts the sign-in flow. Coffee Chats checks that list before it shows you anything, and an ask for a permission that is not grantable never reaches a sign-in page.

After you sign in, the Authorize access page shows the list it asked for, one line per permission, each with the sentence that says what the permission covers. Those sentences are the product's own wording. The [permissions reference](/mcp/scopes.md) is generated from the same source as that page, so the wording on it is the wording you will read.

> [!WARNING]
>
> The consent screen shows the full list of permissions the application asked for, and you approve or deny that list as one choice. If you deny it, nothing is connected.

The connection receives the permissions you approved and nothing else. Approving a wide list does not widen the tools; it only widens which of the 85 tools the connection may call.

## Twenty-two permissions you can grant

Twenty-one of them control tools. The twenty-second, `offline_access`, controls nothing but the life of the connection.

| Kind | Permissions |
| - | - |
| Read | `profile:read`, `booking:read`, `contacts:read`, `meetings:read`, `meetings:transcript:read`, `campaigns:read`, `mail:read`, `jobs:read`, `documents:read`, `integrations:read`, `billing:read` |
| Write | `profile:write`, `booking:write`, `contacts:write`, `meetings:write`, `campaigns:write`, `mail:send`, `jobs:write`, `documents:write` |
| Spends credits | `research:run`, `documents:generate` |
| Connection life | `offline_access` |

`offline_access` is not a permission to read anything. It lets the agent host keep the connection alive with rotating refresh credentials instead of sending you back through sign-in. Without it, the agent's access stops after ten minutes and you sign in again. No tool requires it.

The [permissions reference](/mcp/scopes.md) lists all twenty-two with the consent sentence and the tools each one unlocks.

## What a missing permission does

A tool whose permission was not granted does not return your data. It returns the fixed failure text, `Tool call failed.`, with no code and no reason.

> [!NOTE]
>
> That silence is deliberate. A message saying "you did not grant contacts:read" would itself be a statement about your account, so the connector says only that the call failed. An agent that reads a reason into that text is guessing. Two failures say more, and each arrives only after the permission was granted. A lookup of a record your account does not have names the kind of record it did not find, and a meeting whose transcript Coffee Chats does not hold says that. [Failures that carry no code](/mcp/errors.md) has all three texts.

Ask for the permissions you need at consent time. Probing for them by calling tools tells an agent nothing.

## Read the tool list, not the sentence

A consent sentence is short, and a short sentence is always a little wider than the thing it describes. The last column of the [permissions reference](/mcp/scopes.md) lists the tools that use each permission, generated from the catalogue the connector registers. If a consent sentence ever sounds wider than that list, believe the list.

## Permissions and the tools that need your approval

Nine tools need your approval as well as a permission. The permission lets an agent propose the change as a review request. It does not let the agent make it. [Safe writes and approvals](/mcp/writes.md) describes the difference, and [approvals](/mcp/approvals.md) describes the page you decide on.

Two permissions spend credits. `research:run` backs only `contacts.research.start`. A connection made before research was available does not hold it. To let an agent start research, connect the application again and grant `research:run` on the Authorize access page; nothing else about the connection changes. Proposing research also needs `contacts:read`, because the proposal shows each contact's name. Reading research results needs only `contacts:read`.

`documents:generate` backs `documents.resumes.generate` and `documents.jobs.tailor`, which write a resume or a tailored resume and cover letter and use credits as soon as the agent calls them, with no approval page. Both also need `documents:read`. Your resumes and cover letters have their own permissions: `documents:read` reads them, with their text and download links that work for 15 minutes, and `documents:write` edits a section of one, for free. `jobs:read` and `jobs:write` reach no resume or cover letter, and neither `jobs:write` nor `documents:write` spends credits. A connection made before these tools were available must connect again to grant `documents:read`, `documents:write` and `documents:generate`.

A withdrawal passes two separate gates. The catalogue requires `profile:write` on every call to `actions.cancel`, whatever the withdrawal is about, so a connection holding only `booking:write` can propose an event type change and cannot withdraw it. At the moment of the call, the connection must also still hold the scopes the creating tool recorded on the review request, so a connection that has lost a permission cannot withdraw work it could no longer propose.

## Next steps

> **[Permissions reference](/mcp/scopes.md)**
>
> All twenty-two, with the consent sentence and the tools each unlocks.

> **[Sign-in and credentials](/mcp/authentication.md)**
>
> Where the Authorize access page sits in the sign-in flow.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.