Permit.io MCP integration for AI agents.
Connect AI agents to Permit.io through 13 structured actions, including get tenant, assign role, delete tenant, and unassign role. Review authentication, inp…
- ACTION CONTRACTS
- 13
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Permit.io integration exposes
The Permit.io Agent App exposes 13 provider-backed actions for developer tools and security work. Its current contract lets an authorized agent retrieve a permit.io tenant by id or key, assign a permit.io role to a user, and delete a permit.io tenant by id or key. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Permit.io account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Permit.io capabilities.
Showing 12 of 13 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_tenantREADRetrieve a Permit.io tenant by id or key.
INPUTS: projectId / environmentId / tenantId
assign_roleWRITEAssign a Permit.io role to a user.
INPUTS: projectId / environmentId / user / role / tenant
delete_tenantHIGH IMPACTDelete a Permit.io tenant by id or key.
INPUTS: projectId / environmentId / tenantId
unassign_roleREVIEWRemove a Permit.io role assignment from a user.
INPUTS: projectId / environmentId / user / role / tenant
create_tenantWRITECreate a tenant in a Permit.io environment.
INPUTS: projectId / environmentId / key / name / description
create_userWRITECreate a user in a Permit.io environment.
INPUTS: projectId / environmentId / key / email / first_name
delete_userHIGH IMPACTDelete a Permit.io user by id or key.
INPUTS: projectId / environmentId / userId
get_userREADRetrieve a Permit.io user by id or key.
INPUTS: projectId / environmentId / userId
list_role_assignmentsREADList role assignments in a Permit.io environment.
INPUTS: projectId / environmentId / user / role / tenant
list_tenantsREADList tenants in a Permit.io environment.
INPUTS: projectId / environmentId / search / page / perPage
list_usersREADList users in a Permit.io environment.
INPUTS: projectId / environmentId / search / role / page
update_tenantWRITEPartially update a Permit.io tenant.
INPUTS: projectId / environmentId / tenantId / name / description
INPUT CONTRACTS
Know what the action needs before it runs.
get_tenant
projectIdOPTIONAL- The Permit.io project id or key. Required when the connected API key is not environment-scoped.
environmentIdOPTIONAL- The Permit.io environment id or key. Required when the connected API key is not environment-scoped.
tenantIdREQUIRED- The Permit.io tenant id or key.
assign_role
projectIdOPTIONAL- The Permit.io project id or key. Required when the connected API key is not environment-scoped.
environmentIdOPTIONAL- The Permit.io environment id or key. Required when the connected API key is not environment-scoped.
userREQUIRED- The user id or key receiving the role.
roleREQUIRED- The role id or key to assign or remove.
tenantOPTIONAL- The tenant id or key that scopes the role.
delete_tenant
projectIdOPTIONAL- The Permit.io project id or key. Required when the connected API key is not environment-scoped.
environmentIdOPTIONAL- The Permit.io environment id or key. Required when the connected API key is not environment-scoped.
tenantIdREQUIRED- The Permit.io tenant id or key.
unassign_role
projectIdOPTIONAL- The Permit.io project id or key. Required when the connected API key is not environment-scoped.
environmentIdOPTIONAL- The Permit.io environment id or key. Required when the connected API key is not environment-scoped.
userREQUIRED- The user id or key receiving the role.
roleREQUIRED- The role id or key to assign or remove.
tenantOPTIONAL- The tenant id or key that scopes the role.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Tenant
Retrieve a Permit.io tenant by id or key. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_tenantControl Assign Role
Assign a Permit.io role to a user. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
assign_roleVerify with Get User
Retrieve a Permit.io user by id or key. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_userSAFETY BOUNDARY
Operate Permit.io with explicit limits
- Authorize Permit.io with API key and grant only the provider access required by the selected actions.
- 7 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Treat `delete_tenant` and `delete_user` as high-impact operations and require an explicit approval boundary.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in Permit.io rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the Permit.io task completed successfully.
CONNECTION MODEL
API key
Permit.io API key sent as a Bearer token. Copy an environment key from the Projects screen or active environment menu at https://app.permit.io.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 5
- WRITE SIGNALS
- 5
- HIGH IMPACT
- 2
- REVIEW SIGNALS
- 1
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Permit.io.