MCP server — It logs in as somebody

Every connection acts as one member of one workspace, and the agent sees exactly what that person sees. A key acts as the member an admin picked when they minted it; a sign-in acts as whoever signed in. Either way, fields hidden from that person stay hidden and tables they cannot open stay invisible. No integration-permissions screen exists, because no second set of rules exists — the ones you already set up are the ones that apply. That is also the safest way to scope an agent. Bind it to a client-facing teammate and it cannot read the columns you hid from that teammate, whatever it is asked. Revoking on the Developers page stops a key answering, each person ends their own sign-ins under Settings, and removing a member from the workspace kills their connections with them. RowFold rate-limits per credential, writes every export to the audit trail, and answers a workspace past its trial with a payment-required error, the same as the REST API.