AI: Permissions & Security
Dragon Planner takes security seriously when it comes to AI access. Here's how permissions work with the MCP integration.
Dragon Planner takes security seriously when it comes to AI access. Here's how permissions work with the MCP integration.
Authentication
When your AI assistant connects to Dragon Planner, it goes through the same authentication flow as the web app. The AI acts on your behalf — it has the same access you do, nothing more.
Permission Levels
Your account's permissions control what the AI can do:
| Permission | What It Allows |
|---|---|
workspace:read | List workspaces, list projects, view team members |
project:read | View project dashboards and metrics |
workitem:read | List, search, and view work items and their details |
workitem:write | Create, update, assign, comment, log time, attach files |
workitem:delete | Delete work items (with confirmation) |
sprint:read | View sprints, sprint details, and summaries |
pi:read | View program increments |
If you try to do something you don't have permission for, the AI will let you know which permission is needed.
Builder Seats Only
MCP access is restricted to Builder seats. Team members with Collaborator seats (web-only) will receive an access denied message if they try to connect. This ensures AI integrations are only used by team members who need them.
Rate Limits
To keep things fair and stable, each plan has limits on:
- ⏱️ Calls per minute — How many requests the AI can make per minute
- 🔗 Concurrent connections — How many AI sessions can be active at once
These limits are per Builder seat. If you hit a rate limit, the AI will pause briefly and retry.
Data Isolation
The AI can only see data belonging to your organization. There's no cross-tenant access — your projects, work items, and team data are completely isolated.
What the AI Can't Do
- ❌ Delete workspaces or projects
- ❌ Change billing or subscription settings
- ❌ Invite or remove team members
- ❌ Modify user permissions or roles
- ❌ Access other organizations' data
These administrative actions must be done through the web app by authorized team members.
Tips
- 💡 The AI always identifies what it's about to do before making changes. Destructive actions like deletion require explicit confirmation.
- 💡 All actions taken by the AI are logged in the Audit Log under your name, so there's a full trail.
- 💡 If you're an admin and want to control who can use AI features, manage seat types on the Team page.
AI & MCP Overview
Dragon Planner integrates with AI assistants like Claude through the Model Context Protocol (MCP). This allows your AI to read, create, and manage your w...
AI: Setting Context & Navigation
Before your AI assistant can work with a project, it needs to know *which* workspace and project you're talking about. This is called setting context.