Modes. A connection's permissions per company read as one of three modes, shown on it under Dev Tools → MCP and editable there:

Mode	What it can do
Read-only	Every view permission you hold at that company. It can't change anything.
Can make changes	Those, plus every edit permission you hold — create, update, send. Not admin-level permissions, refunds, wholesale costs, permissions and invitations, SSO and security, billing, payouts, domains, mailboxes, AI agents or data migration, and nothing from Builder or Pixelbase's own tiers.
Custom	Anything else: permissions chosen one by one. A connection made before modes existed keeps what it had and shows as Custom if it matches neither.

A mode is never stored — it's read off the permissions, so what you see is what is enforced. And it never exceeds your own role: it is drawn from what you hold at that company, today.

The permission wall. When an assistant asks for something its permissions don't cover, it doesn't hit a dead end. The call fails with permission_required and, in the text and in structuredContent:

what it was attempting and at which company,
the exact permissions it is missing (missingScopes, each with a readable label and whether it can make changes), and
approvalUrl — one link, https://www.pxb.app/connect/approve/<token>.

A tool the connection can't use is never listed, so an assistant can also ask outright: request_permissions takes a tool name (or permission names) and returns the same link, and search_tools and describe_tool say that a tool exists but isn't granted.

The link is for one decision. It lasts about twenty minutes (an operator can set it between five and sixty), works once, and belongs to this connection, this company and exactly those permissions. It carries no access of its own: opening it only shows the request, and approving takes you, signed in as the person who connected the assistant, and the same code from your phone that connecting one takes. Anyone else who opens it learns nothing and can change nothing.

The approval page says in plain words which assistant is asking, for which company, what it was trying to do and exactly what it wants — marking anything that can make changes. Approve adds just those permissions to that company; Deny closes the request; Review all permissions opens the connection for the full list. If you don't hold a permission yourself it can't be granted, and the page says to ask an admin. Expired, used, declined and disconnected links say so and tell the assistant's person what to do next.

It takes effect on the next call. Permissions are read live, so the assistant simply retries — no reconnecting. The server also tells a listening client its tool list changed. Each request and each decision is recorded in the connection's History in Dev Tools.