This page explains what a connected AI assistant may do in plnnrly, and what stops it from doing more. It is written for anyone who connects an assistant, and for administrators who decide whether to switch MCP on.
It acts as you
It acts as you: it can see and change what your account can, and nothing more.
- plnnrly checks your permissions again on every request the assistant makes. A change to your role applies at once.
- What you may not see answers as if it does not exist, exactly as in the REST API.
- The assistant cannot sign in as anyone else. A support session cannot connect an assistant at all.
What counts as deleting
plnnrly treats these calls as deleting:
- any delete, including one that can be undone later
- a permanent delete, such as deleting a project with
force - any operation marked as destructive in the API (today, all of these are deletes)
When plnnrly cannot tell whether a call deletes something, it treats the call as deleting.
Two locks on deleting
An assistant can only delete when both locks are open:
- Allow destructive actions is on. It is an organisation setting, and it is off unless an administrator switched it on; see For administrators.
- The assistant sends your confirmation (
confirm) with the call, after you agreed to the delete.
If either is missing, nothing is deleted. The refusal never tells the assistant whether the record exists.
Overwriting asks too
Replacing the whole text of a Drive document discards its formatting, and anything others typed since the assistant read it. That is not deleting, so it does not need Allow destructive actions. The assistant must still send your confirmation. Adding text to the end of a document (mode: append) needs neither, because nothing already there changes.
Your client asks first
plnnrly marks Write to the API, the one tool that can change data, so that clients ask you before they use it. Most clients let you allow it for one conversation, or always. Read each request before you allow it, and only allow it always for work you are comfortable with.
The other three tools only read.
Retries
Writes over MCP are not protected against duplicates. If a write timed out, the assistant should read the data again before it retries, so it does not create the same record twice.
Apps that also ask for API access
Most AI clients only ask to use the MCP server. If an app's sign-in also asked for REST API access, it is held to the access it asked for over MCP as well. REST API sign-ins never include deleting, so such an app cannot delete over MCP. Connecting such an app also needs the Manage API tokens permission.
Who sees your data
What the assistant reads from plnnrly goes to the AI client you connected, and from there to the AI provider behind it. Their terms decide what happens to it. Connect only clients your organisation trusts with its data.
Stopping access
- To cut off one app, use Disconnect in the AI panel; see Disconnect an app.
- An administrator can switch MCP off for the whole organisation. Connected clients are refused from that moment; see For administrators.