---
title: Make a role for an AI client
description: "Give an AI client only the folders it needs, with a small role made just for it. Easier to reason about, and easy to spot later and revoke."
section: AI agents
order: 20
audience: [owner, admin, agent-user]
status: published
lastVerified: 2026-09-15
sources:
  - src/mcp/consent.ts
  - web/src/components/app/pages/ConnectClientPage.tsx
  - web/src/components/app/permissions/CreateRoleDialog.tsx
  - src/lib/permissions.ts
---

When you connect an AI client, you pick which of your custom roles it gets. If your only role gives you a lot of access, so does the client. A small role made for the client's job is safer, and easy to spot later on the **AI agents** page.

Creating roles needs an Owner or Admin. If that's not you, send them this page.

## Set it up

1. Open **Roles** and select **Create role**. Choose **Start empty**.
2. Name it after the job, like "AI: read approved exports".
3. Add one rule: **Allow**, the connection and bucket, the folder in **Prefix**, and tick **Read**. Tick **Write** only if the client needs to upload.
4. Select **Save role**.
5. On **People**, give the role to the person who'll connect the AI client, and select **Save**.

That person will see the role on the consent screen, alongside their other roles.

## Tips

- Give Read only, unless the client really needs to upload. Through MCP, Write lets the client upload and overwrite files, but not delete them.
- Point the rule at one folder rather than a whole bucket.
- If the client must stay out of one sub-folder, add a **Deny** rule for it. Deny always wins, even over the person's other roles if they select those too.
- Before connecting the client, have the person open the folder in the web app to check the role works.

More patterns in [folder access recipes](/docs/access/prefix-recipes/).