The three permission levels
Thinking about permissions in levels makes everything clearer.
- Read: the AI looks at data but doesn't change it. The safest level, but not harmless: even just reading confidential information can carry it to the wrong place.
- Write: the AI can modify or create. This is where the risk of real damage arises (an overwritten file, deleted data).
- Execute: the AI can perform actions (send, pay, run commands). The most powerful level, and the most delicate.
The rule, borrowed from information security, is least privilege: give each server only the level it truly needs, nothing more.
How to do it
These apply to any assistant that supports MCP.
- Start from the minimum. For each server, ask yourself the lowest level that suffices. A server whose only job is to let you analyze documents wants read access, not write.
- Narrow the scope. Specify the exact folders, tables, or accounts, never "everything." The operational syntax, for a filesystem server limited to a single folder:
{
"mcpServers": {
"documents": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/yourname/Documents/work"]
}
}
}
- Keep confirmations on. Serious assistants ask for your go-ahead before an action that deletes, sends, or pays. Don't turn these prompts off to save time: they're the last net beneath you.
- Review now and then. Check which servers you have active and at what level, and remove what you don't use. A permission granted and forgotten is a door left open.
A concrete example
Elena connects the AI to her clients' documents and to her calendar. For the documents she grants read only, on a specific folder: the AI can analyze them but not delete them. For the calendar, where she wants the AI to create events, she accepts write level but keeps confirmation on before every new appointment.
A week later, the AI proposes to "free up the morning by moving three meetings." Without the confirmation it would have moved them; with the confirmation, Elena sees the proposal, notices one meeting was with an important client, and leaves it where it is. Least privilege on the documents and confirmation on the calendar did exactly their job: usefulness without surprises.
When it does NOT work (and how to fix it)
If you turned off confirmations for convenience
It's the shortcut you pay dearly for: a wrong action goes off without you seeing it. Turn confirmations back on for all operations that delete, send, or pay. A few extra clicks are worth far less than lost data or an email sent by mistake.
If a server asks for more access than necessary
If a server insists on being able to write everywhere just to read some files, that's a warning sign. Look for a more limited version of the server (for example, read-only) or another server that does the same job while asking for less.
If you don't understand what a permission grants
Never grant access you don't understand. Ask the AI itself to explain in plain words what that line of configuration allows before you save it. A permission granted without understanding it is the most common way to open a door you thought was closed.
A tip from someone who actually uses it
Treat permissions like your house keys: you don't hand them to just anyone and you don't make pointless copies. For each server, before connecting it, write down on a sheet of paper what it will be able to do and why. If you can't answer the "why," that permission shouldn't be granted. This one-minute habit prevents almost every problem before it arises.
Frequently asked questions
Do I have to set up complicated permissions like in a company?
No, for personal use three things are enough: trusted servers, restricted access, and confirmations on. Elaborate permission systems with roles and rules are for companies with many users; what you need is the discipline of least privilege, not a complex apparatus.
Do confirmations slow the work down too much?
Only on serious actions, and that's where you want them. Read-only operations usually ask for nothing and go right through. The confirmation kicks in where it really matters: before an action that, if wrong, can't be undone.
Does setting permissions well make me completely safe?
Here's the misunderstanding to clear up: permissions are the most important layer, but not the only one. Where the server comes from also matters (trusted sources only) and what's in the data you let it read, because a trap-text inside a file can try to hijack the AI. Minimum permissions plus trusted servers plus confirmations on: that's the combination that protects, not a single measure.