---
title: Approve an AI client
description: "What to check on the Connect an AI client screen before you select Authorize: the client, the organisation, the roles, and how long access lasts."
section: AI agents
order: 70
audience: [owner, admin, member, agent-user]
status: published
lastVerified: 2026-09-15
sources:
  - web/src/components/app/pages/ConnectClientPage.tsx
  - src/mcp/consent.ts
---

When you connect an AI client, it opens a **Connect an AI client** page in quickS3. This is where the client gets its access, so read it before you approve. Go through it top to bottom:

**Client.** The name is whatever the client says it is, so it proves nothing. Check the "returns to" address instead: it should match the app you just started, like `localhost` for a command-line tool. If it doesn't, select **Deny**.

**Organization.** The client only gets access to this organisation. If it's the wrong one, select **Deny**, switch organisation with the switcher at the top of the page, and start again from the client.

**Roles to delegate.** Every role you have is ticked to begin with. Untick everything the client doesn't need. Under each role you'll see its rules, like "Allow read on reports/2026/". The client can do exactly what the ticked roles allow, nothing more.

**Access lifetime.** 30, 60, or 90 days. Pick the shortest that covers the job. You can revoke earlier at any time.

Then select **Authorize** to approve, or **Deny** to refuse. Denying is always safe: nothing is created.

## Clients you've already connected

At the bottom of the page, **Your existing AI access in this organization** lists clients you've already approved here, with a **Revoke** button for each. It's a good moment to clean up ones you no longer use.

## If something's wrong

- **"Connection request expired".** Consent requests last 10 minutes and work once. Start the connection again from your AI client.
- **"You have no data-access roles in this organization".** You need a custom role first. Ask an Owner or Admin, or see [make a role for an AI client](/docs/agents/create-role/).
- **Authorize is greyed out.** No role is ticked. Tick at least one.