Connected accounts and employee access
Understand the difference between a workspace connection and an AI employee's tool switch, and where the approval gate carries the risk decision.
A connected account and an employee's access to it are separate objects in the Yodu interface.
Workspace connection
The connection represents an account authorized for the workspace, such as a Gmail inbox, GitHub installation, Stripe account, or HubSpot portal.
It answers: which account has the workspace connected?
Employee access
Access is a per-employee switch on each connected capability.
It answers: which employees can see and use it?
Why the separation matters
One Stripe account might be connected to the workspace. The finance employee keeps it enabled while the content and research employees have it disabled — they never see Stripe at all.
The switch decides visibility only. Whoever holds an enabled tool, anything external or irreversible still stops at the approval gate for a human decision.
Access states
- Enabled (default): the employee sees the tool and can use it, within the approval gate
- Disabled: the tool is hidden entirely — omitted from the employee's runtime configuration; custom MCP servers are removed from that employee's private registry
There are no per-tool modes between these two. The old draft-only, approval-required, and autonomous tiers were replaced by the approval gate, which applies to risky action classes regardless of how a tool is configured.
Workspace-wide access
Leave capabilities that every employee legitimately needs, such as a general research skill, enabled everywhere. Disable connected accounts per employee when the underlying data is sensitive or role-specific.
Disable or remove?
| Goal | Action |
|---|---|
| Stop one employee from using the account | Disable that employee's switch |
| Restore access later | Flip the switch back on |
| Replace expired authorization | Reconnect the account |
| Remove the provider account from the company | Remove the connection after reviewing dependent employees |
Review habit
Audit tool switches when:
- an employee changes roles
- a human member leaves
- an account is replaced
- the employee begins higher-risk work
- a schedule is added
- session allowances start being granted routinely in Approvals
The access screen should make the current toolset understandable without reading configuration files or exposing credentials. See Tool access per employee for the full model.
Tool access per employee
Every connected app and MCP server is a per-employee switch — enabled means the employee can see and use it, disabled hides it entirely. Risky actions always stop for approval.
Platform API and MCP
Connect an external AI client or program to one Yodu workspace with a scoped API key and the curated REST and platform MCP surfaces.