ACL Configuration
Each MCP server can have an independent ACL with the following fields:
| Field | Type | Description |
|---|---|---|
allowedTeams |
string[] | Teams whose members are granted access |
allowedUsers |
string[] | Individual users granted access |
denyUsers |
string[] | Individual users explicitly denied access |
Evaluation Order:
- Deny list takes priority. If a user appears in
denyUsers, access is denied regardless of team or user allow lists. - Allow lists are additive. A user is granted access if they appear in
allowedUsersor are a member of any team inallowedTeams. - Team membership is resolved via the tenant’s team membership configuration in AgentWatch.