> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meshpilot.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes & roles

> How a key's brands, platforms, access mode, and the minter's role combine into a capability ceiling.

Every MCP key carries a **capability ceiling** made of four dimensions. The effective power of a key is the intersection of all four with the live access of the person who minted it.

## The four scope dimensions

<CardGroup cols={2}>
  <Card title="Brands" icon="building">
    Which brands the key can touch. Empty = every brand the minter can access.
  </Card>

  <Card title="Platforms" icon="layers">
    Which platforms the key can reach (Meta, Amazon, Amazon Seller, Shopify, Google Ads, TikTok, LinkedIn, X, PostHog). Empty = all.
  </Card>

  <Card title="Access mode" icon="lock">
    <b>read</b> — audits, reads, status only. <b>write</b> — can also stage approvals and mutations (still HITL-gated).
  </Card>

  <Card title="Operations" icon="list">
    Optionally narrow to specific operations (e.g. only <code>list\_\*</code> reads), tighter than the read/write split.
  </Card>
</CardGroup>

## Roles re-intersect on every request

A key never grants more than its minter currently has. Mesh Pilot resolves access **live** on each call:

* **Per-brand role.** Each member is a `viewer` (read-only) or `operator` (read + write) on each brand they're on. A write-mode key minted by someone who is only a viewer on Brand A cannot write to Brand A.
* **Workspace role.** Workspace `owner` / `admin` can see org-wide audit across every key; `operator` / `viewer` see their own.
* **Live re-check.** The ceiling is re-computed against current access every request. Remove someone's access to a brand and every key they minted loses that brand immediately.

## Worked example: outside consultant

You want a consultant to analyse one brand's Amazon Ads, read-only, for two weeks.

Mint a key with:

* **Brands:** `ayurpet` only
* **Platforms:** `amazon` only
* **Access mode:** read
* **Expiry:** 14 days
* **Rate limit:** 500 calls/day

The consultant can read Ayurpet's Amazon Ads performance and run audits — and literally nothing else. No writes, no other brand, no other platform. It self-expires, and you can see every call it made.

## What a denied call looks like

If a key attempts something outside its ceiling — a brand it isn't scoped to, a platform it can't reach, or a write from a read-only key — the server refuses and records a `denied` entry in the [audit log](/developers/audit-log) with the reason. The action never reaches the platform.

<Card title="See the audit log" icon="arrow-right" href="/developers/audit-log">
  Every ok / denied / error, per key.
</Card>