Grant a scoped application role

Replace the placeholders with values from your own authorized scope before copying this prompt into an MCP client.

Inputs

• {{workspace_id}} Stable workspace ID.
• {{application_id}} Stable application ID.
• {{subject_id}} Exact directory subject to grant.
• {{role}} Authorized application role, such as Reader.
• {{request_key}} Stable idempotency key for the exact grant.

Prompt

As the authorized application or workspace administrator, verify {{subject_id}} and the target {{workspace_id}} / {{application_id}}.
Use read_v2_program with security.application.access.list to inspect the current direct grant. Pass nextAfterSubjectId as afterSubjectId to continue.
Use set_v2_application_access with security.application.access.set, subjectId {{subject_id}}, action grant, role {{role}}, and idempotency_key {{request_key}}.
Read security.application.receipt.read with operationId {{request_key}}. Read security.application.access.list again and return the committed receipt and resulting direct grant.
Stop if the subject, current grant or requested role would change beyond the authorized scope.

Example inputs

In the disposable Operating Data Cube, use an active directory subject with no prior direct grant in this application. The example subject ID is reader. Verify the committed receipt and the Reader row, then use that subject's own signed-in session to confirm it can read a bounded slice. Its catalog omits numeric write functions.

{"languageVersion":2,"function":"security.application.access.set","arguments":{"subjectId":"reader","action":"grant","role":"Reader"}}

Tools used include list_v2_functions, read_v2_program, set_v2_application_access. See the module guidelines and tool index.