Inspect effective access

Replace the placeholders with values from your own authorized scope before copying this prompt into an MCP client.

Inputs

• {{workspace_id}} Stable workspace ID.
• {{application_id}} Stable application ID.
• {{subject_id}} Directory-verified subject ID.
• {{requested_action}} Action and relevant data scope to check.

Prompt

For {{subject_id}} in {{workspace_id}} / {{application_id}}, inspect access for {{requested_action}} using only authorized reads.
If workspace group grants are relevant, discover security.workspace.group-access.list and call it with read_v2_workspace_access.
Use read_v2_program with security.application.access.list and security.application.group-access.list where authorized. Follow each bounded cursor until the relevant grant is found or the list is complete. Use security.application.dimension-access.read for a direct grant.
Read security.application.dimension-policy.active.read and the applicable member tags with security.application.member-tags.read. Match any group grants to verified membership. Report direct roles, group roles, tag assignments and active policy separately.
If membership, a grant page, policy or member metadata is unavailable, report the gap before drawing an effective-access conclusion.
Stop before grant changes or testing access by impersonation.

Example inputs

Use the reader in the dimensional-access example. The direct grant is Reader, the assigned Entity read tag is DocsPointARead, and the active test policy filters unauthorized rows. An independently signed test reader session can verify the two points without an administrator impersonating the reader.

Tools used include read_v2_workspace_access, read_v2_program, list_v2_functions. See the module guidelines and tool index.