Approve an AI client
What to check on the Connect an AI client screen before you select Authorize: the client, the organisation, the roles, and how long access lasts.
When you connect an AI client, it opens a Connect an AI client page in quickS3. This is where the client gets its access, so read it before you approve. Go through it top to bottom:
Client. The name is whatever the client says it is, so it proves nothing. Check the “returns to” address instead: it should match the app you just started, like localhost for a command-line tool. If it doesn’t, select Deny.
Organization. The client only gets access to this organisation. If it’s the wrong one, select Deny, switch organisation with the switcher at the top of the page, and start again from the client.
Roles to delegate. Every role you have is ticked to begin with. Untick everything the client doesn’t need. Under each role you’ll see its rules, like “Allow read on reports/2026/”. The client can do exactly what the ticked roles allow, nothing more.
Access lifetime. 30, 60, or 90 days. Pick the shortest that covers the job. You can revoke earlier at any time.
Then select Authorize to approve, or Deny to refuse. Denying is always safe: nothing is created.
Clients you’ve already connected
At the bottom of the page, Your existing AI access in this organization lists clients you’ve already approved here, with a Revoke button for each. It’s a good moment to clean up ones you no longer use.
If something’s wrong
- “Connection request expired”. Consent requests last 10 minutes and work once. Start the connection again from your AI client.
- “You have no data-access roles in this organization”. You need a custom role first. Ask an Owner or Admin, or see make a role for an AI client.
- Authorize is greyed out. No role is ticked. Tick at least one.