Permissions

Slab5 starts with simple roles and explicit scopes. Every MCP tool and API route declares the scopes it requires.

Roles and scopes

Initial roles: owner, admin, member, agent, and readonly.

Initial scopes include crm:read, crm:write, support:read, support:write, tasks:read, tasks:write, activity:read, activity:write, cms:read, cms:write, assets:read, assets:write, integrations:read, integrations:write, analytics:read, analytics:write, bi:read, bi:write, audit:read, and settings:admin.

In the hosted control plane, workspace administration requires local owner or admin membership in the target workspace. member and readonly users are not allowed to create or revoke API keys or MCP clients, change module access, rename workspaces, send invitations, or change MCP auth policy.

WorkOS organization roles are mirrored into local Slab5 workspace roles when a user loads a Slab5 Team in the control plane. Unknown WorkOS role slugs default to local member access.

Scope model

Scopes are workspace-scoped permissions attached to a token. Every MCP tool and REST API route declares the exact scopes it requires before the call is accepted.

  • *:read scopes allow listing, searching, and fetching workspace resources.
  • *:write scopes allow creating or changing workspace resources and always produce audit events.
  • settings:admin is reserved for workspace and token administration.
  • Agents should receive the smallest scope set needed for their workflow.
  • Scopes do not bypass module enablement. A token with support:write still cannot call Support tools unless the Support module is enabled in that workspace.

OAuth MCP grants

Hosted OAuth MCP access starts from the signed-in user's Slab5 workspace role. Workspace owners and admins can optionally add an explicit OAuth MCP grant for a specific OAuth subject from the MCP Clients page.

Explicit OAuth grants can reduce access but cannot increase it. The effective OAuth MCP scopes are the intersection of the user's workspace role scopes, the grant scopes when a grant exists, and OAuth token permissions when the token includes them.

This lets an admin keep normal console access while limiting a hosted MCP client to the exact scopes needed for a workflow. For example, a user with broad workspace access can grant an OAuth-connected client only crm:read, crm:write, and tasks:write.

Destructive actions

Account and workspace deletion require explicit control-plane authorization and typed confirmation. Slab5 uses soft-delete or archive behavior where the schema supports it, and revokes credentials, MCP clients, workspace grants, and memberships before removing active access.

Owned Team deletion archives the team tenant and its local Slab5 access artifacts. Leaving a Team where the user is only a member removes the user's local membership without archiving the Team.

Workspace deletion is limited to users with owner/admin-level workspace administration. Member and readonly users do not see the workspace delete action.

Permissions and scopes table

The table below is rendered from the shared contract files. If a tool or route changes behavior, update packages/shared/contracts first and let the docs reflect the new contract.

Module scope inventory

ModuleResourcesScopesStatus
Activity Log
activity_log
activities
activity:readactivity:write
MVP
Tasks
tasks
tasks
tasks:readtasks:write
MVP
CRM
crm
leads, lead_conversions, contacts, companies, deal_stages, deals, notes, invoices, payments, accounting_accounts, accounting_journal_entries
crm:readcrm:write
MVP
Support
support
support_queues, support_tickets, support_ticket_messages, support_ticket_comments
support:readsupport:write
MVP
CMS
cms
sites, collections, entries, revisions, marketing_campaigns, marketing_posts
cms:readcms:write
MVP
Files, Media, and Content Storage
assets
assets
assets:readassets:write
MVP
Webhooks, Events, and Integrations
integrations
integration_event_types, webhook_endpoints, webhook_deliveries
integrations:readintegrations:write
MVP
Analytics Governance
analytics_governance
events, properties, tracking_plans
analytics:readanalytics:write
MVP
Product Analytics and BI
product_analytics_bi
bi_dashboards, bi_reports, bi_datasets, bi_metrics, bi_queries, bi_exports, bi_scheduled_artifacts
bi:readbi:write
Experimental

Tool and API scope map

ModuleMCP toolAPI routeRequired scopesStatus
CRM
MVP
create_contact

Create a CRM contact in the current workspace.

POST/v1/contacts
crm:write
MVP
CRM
MVP
search_contacts

Search contacts by name, email, company, or free-text query.

GET/v1/contacts
crm:read
MVP
CRM
MVP
create_company

Create a company account in the CRM module.

POST/v1/companies
crm:write
MVP
CRM
MVP
search_companies

Search company accounts by name, domain, or free-text query.

GET/v1/companies
crm:read
MVP
CRM
MVP
create_lead

Create a CRM lead before it is converted into a contact, company, or deal.

POST/v1/leads
crm:write
MVP
CRM
MVP
list_leads

List leads by status, source, search text, or custom field.

GET/v1/leads
crm:read
MVP
CRM
MVP
convert_lead

Convert a lead into contact, company, and optionally deal records.

POST/v1/leads/{lead_id}/convert
crm:write
MVP
CRM
MVP
create_deal_stage

Create a custom deal stage for the workspace pipeline.

POST/v1/deal-stages
crm:write
MVP
CRM
MVP
list_deal_stages

List workspace deal stages, including custom stages.

GET/v1/deal-stages
crm:read
MVP
CRM
MVP
create_deal

Create a deal associated with a company or contact.

POST/v1/deals
crm:write
MVP
CRM
MVP
update_deal_stage

Move an existing deal to a new pipeline stage. Deprecated in favor of update_deal.

PATCH/v1/deals/{deal_id}
crm:write
Deprecated
CRM
MVP
update_deal

Update deal stage, amount, or currency.

PATCH/v1/deals/{deal_id}
crm:write
MVP
CRM
MVP
create_invoice

Create an invoice with product or service line items.

POST/v1/invoices
crm:write
MVP
CRM
MVP
list_invoices

List invoices by status, customer, deal, or custom field.

GET/v1/invoices
crm:read
MVP
CRM
MVP
record_payment

Record a payment against an invoice.

POST/v1/payments
crm:write
MVP
CRM
MVP
create_accounting_account

Create a basic chart-of-accounts account.

POST/v1/accounting/accounts
crm:write
MVP
CRM
MVP
list_accounting_accounts

List chart-of-accounts records.

GET/v1/accounting/accounts
crm:read
MVP
CRM
MVP
create_journal_entry

Create a balanced accounting journal entry.

POST/v1/accounting/journal-entries
crm:write
MVP
CRM
MVP
list_journal_entries

List accounting journal entries.

GET/v1/accounting/journal-entries
crm:read
MVP
Tasks
MVP
create_task

Create a task for a user, agent, contact, company, or deal.

POST/v1/tasks
tasks:write
MVP
Tasks
MVP
list_tasks

List tasks by status, assignee, due date, or related resource.

GET/v1/tasks
tasks:read
MVP
Tasks
MVP
complete_task

Mark a task complete in the current workspace. Deprecated in favor of update_task.

PATCH/v1/tasks/{task_id}
tasks:write
Deprecated
Tasks
MVP
update_task

Update a task status, including canceling or reopening it.

PATCH/v1/tasks/{task_id}
tasks:write
MVP
Activity Log
MVP
log_activity

Record a workspace activity such as a note, call, email, meeting, or agent action.

POST/v1/activities
activity:write
MVP
Activity Log
MVP
search_activity

Search activity records by text, type, date, or related resource.

GET/v1/activities
activity:read
MVP
Support
MVP
create_support_queue

Create a support queue or inbox with default assignment and SLA targets.

POST/v1/support/queues
support:write
MVP
Support
MVP
list_support_queues

List support queues by status, search text, or custom field.

GET/v1/support/queues
support:read
MVP
Support
MVP
create_support_ticket

Create a support ticket linked to customers, CRM records, invoices, and SLA targets.

POST/v1/support/tickets
support:write
MVP
Support
MVP
list_support_tickets

List support tickets by status, priority, queue, owner, customer links, search text, or custom field.

GET/v1/support/tickets
support:read
MVP
Support
MVP
update_support_ticket

Update support ticket status, priority, queue, assignment, tags, category, SLA targets, or custom fields.

PATCH/v1/support/tickets/{ticket_id}
support:write
MVP
Support
MVP
add_support_ticket_message

Add an inbound, outbound, or internal message to a support ticket conversation.

POST/v1/support/tickets/{ticket_id}/messages
support:write
MVP
Support
MVP
list_support_ticket_messages

List conversation messages for a support ticket.

GET/v1/support/tickets/{ticket_id}/messages
support:read
MVP
Support
MVP
add_support_ticket_comment

Add an internal note or pinned comment to a support ticket.

POST/v1/support/tickets/{ticket_id}/comments
support:write
MVP
Support
MVP
list_support_ticket_comments

List internal comments and notes for a support ticket.

GET/v1/support/tickets/{ticket_id}/comments
support:read
MVP
CMS
MVP
create_collection

Create a CMS collection that defines a content type for entries.

POST/v1/cms/collections
cms:write
MVP
CMS
MVP
create_cms_site

Create a website or marketing site managed by the CMS.

POST/v1/cms/sites
cms:write
MVP
CMS
MVP
list_cms_sites

List CMS-managed websites.

GET/v1/cms/sites
cms:read
MVP
CMS
MVP
create_entry

Create a CMS entry in a collection.

POST/v1/cms/entries
cms:write
MVP
CMS
MVP
search_entries

Search CMS entries by collection, status, title, or free-text query.

GET/v1/cms/entries
cms:read
MVP
CMS
MVP
update_entry_status

Move a CMS entry between draft, review, published, and archived states. Deprecated in favor of update_entry.

PATCH/v1/cms/entries/{entry_id}
cms:write
Deprecated
CMS
MVP
update_entry

Update a CMS entry title, fields, or publishing status and create a revision.

PATCH/v1/cms/entries/{entry_id}
cms:write
MVP
CMS
MVP
create_marketing_campaign

Create a marketing campaign for website, blog, email, social, or paid channels.

POST/v1/marketing/campaigns
cms:write
MVP
CMS
MVP
list_marketing_campaigns

List marketing campaigns by status, channel, or custom field.

GET/v1/marketing/campaigns
cms:read
MVP
CMS
MVP
create_marketing_post

Create a social, blog, email, or website marketing post linked to an optional campaign or CMS entry.

POST/v1/marketing/posts
cms:write
MVP
CMS
MVP
list_marketing_posts

List marketing posts by channel, status, campaign, or custom field.

GET/v1/marketing/posts
cms:read
MVP
Files, Media, and Content Storage
MVP
create_asset_upload_intent

Register workspace asset metadata and create a signed upload URL.

POST/v1/assets
assets:write
MVP
Files, Media, and Content Storage
MVP
complete_asset_upload

Mark an uploaded workspace asset as available after the client uploads the object to the signed URL.

POST/v1/assets/{asset_id}/complete
assets:write
MVP
Files, Media, and Content Storage
MVP
search_assets

Search workspace asset metadata by text, type, status, or linked resource.

GET/v1/assets
assets:read
MVP
Files, Media, and Content Storage
MVP
get_asset_download_url

Retrieve asset metadata with a signed download URL.

GET/v1/assets/{asset_id}
assets:read
MVP
Files, Media, and Content Storage
MVP
archive_asset

Archive an asset in the current workspace without deleting its metadata.

DELETE/v1/assets/{asset_id}
assets:write
MVP
Analytics Governance
MVP
define_event

Define an analytics event in the workspace tracking plan.

POST/v1/analytics/events
analytics:write
MVP
Analytics Governance
MVP
list_events

List analytics event definitions in the workspace tracking plan.

GET/v1/analytics/events
analytics:read
MVP
Analytics Governance
MVP
define_property

Define a reusable analytics property for the tracking plan.

POST/v1/analytics/properties
analytics:write
MVP
Analytics Governance
MVP
validate_event

Validate an event payload against the workspace tracking plan.

POST/v1/analytics/events/validate
analytics:read
MVP
Webhooks, Events, and Integrations
MVP
list_integration_event_types

List subscribable integration and webhook event types.

GET/v1/integrations/events
integrations:read
MVP
Webhooks, Events, and Integrations
MVP
register_integration_event_type

Register a workspace-specific integration event type.

POST/v1/integrations/events
integrations:write
MVP
Webhooks, Events, and Integrations
MVP
create_webhook_endpoint

Create a signed webhook endpoint subscription.

POST/v1/webhooks
integrations:write
MVP
Webhooks, Events, and Integrations
MVP
list_webhook_endpoints

List workspace webhook endpoint subscriptions.

GET/v1/webhooks
integrations:read
MVP
Webhooks, Events, and Integrations
MVP
update_webhook_endpoint

Update webhook endpoint configuration or lifecycle state.

PATCH/v1/webhooks/{webhook_id}
integrations:write
MVP
Webhooks, Events, and Integrations
MVP
send_test_webhook_event

Queue a signed test delivery for a webhook endpoint.

POST/v1/webhooks/{webhook_id}/test
integrations:write
MVP
Webhooks, Events, and Integrations
MVP
list_webhook_deliveries

List webhook delivery attempts and retry state.

GET/v1/webhooks/{webhook_id}/deliveries
integrations:read
MVP
Product Analytics and BI
Experimental
list_bi_dashboards

List Product Analytics and BI dashboards in the current workspace.

GET/v1/bi/dashboards
bi:read
Experimental
Product Analytics and BI
Experimental
create_bi_dashboard

Create a local, provider-neutral BI dashboard definition.

POST/v1/bi/dashboards
bi:write
Experimental
Product Analytics and BI
Experimental
list_bi_reports

List BI reports, optionally filtered by dashboard or dataset.

GET/v1/bi/reports
bi:read
Experimental
Product Analytics and BI
Experimental
create_bi_report

Create a local BI report definition linked to optional dashboard and dataset records.

POST/v1/bi/reports
bi:write
Experimental
Product Analytics and BI
Experimental
list_bi_datasets

List local BI dataset definitions.

GET/v1/bi/datasets
bi:read
Experimental
Product Analytics and BI
Experimental
create_bi_dataset

Create a provider-neutral dataset definition using local/mock metadata.

POST/v1/bi/datasets
bi:write
Experimental
Product Analytics and BI
Experimental
list_bi_metrics

List workspace BI metric definitions.

GET/v1/bi/metrics
bi:read
Experimental
Product Analytics and BI
Experimental
create_bi_metric

Create a workspace BI metric expression.

POST/v1/bi/metrics
bi:write
Experimental
Product Analytics and BI
Experimental
run_bi_query

Run a BI query or built-in workspace dataset and optionally persist the query definition.

POST/v1/bi/queries/run
bi:write
Experimental
Product Analytics and BI
Experimental
create_bi_export

Create a BI export artifact for a query or report.

POST/v1/bi/exports
bi:write
Experimental
Product Analytics and BI
Experimental
update_bi_object

Update editable BI object metadata within the current workspace.

PATCH/v1/bi/{collection}/{id}
bi:write
Experimental
Product Analytics and BI
Experimental
archive_bi_object

Archive a BI object in the current workspace. Export artifacts are expired.

DELETE/v1/bi/{collection}/{id}
bi:write
Experimental
Workspace
Available
get_workspace_assistant_summary

Return safe workspace metadata summaries for the Workspace Assistant without exposing raw customer-owned content.

GET/v1/assistants/workspace/summary
data_agents:read
Available
Workspace
Available
create_workspace_assistant_run

Run the billable Workspace Assistant against safe workspace metadata and summaries, recording AgentGrid logs, retrieval/tool records, cost events, and credit usage.

POST/v1/assistants/workspace/runs
data_agents:write
Available
Workspace
Available
create_slab5_guide_session

Create a ChatKit-ready Slab5 Guide support session descriptor backed by Slab5-owned knowledge.

POST/v1/assistants/slab5-guide/sessions
data_agents:read
Available
Workspace
MVP
get_workspace_summary

Return workspace metadata, enabled modules, and high-level usage context.

GET/v1/workspace
crm:readsupport:readtasks:readactivity:readcms:readassets:readintegrations:readanalytics:readbi:read
MVP

Was this page helpful?