Security & Permissions
AI agents run inside the same security boundaries as any other Simplio3D API client. Connecting an assistant does not create a new privilege path into your data.
Writes are controlled by construction
Every tool is registered as read-only or as a fully-declared write tool — the registry refuses anything in between. Write tools never mutate directly: they build a plan, and high-risk changes (pricing, SKUs, deletions, bulk edits, shared materials) only execute after the workspace user confirms the plan in the app. Every applied change is snapshotted (undoable), re-validated, audited and rate-limited. Publishing, integrations, customer communication and asset uploads remain out of reach entirely.
How clients know which calls change data
Every tool is published with a title and all three MCP safety hints: readOnlyHint, destructiveHint and openWorldHint. Clients such as Claude and ChatGPT use them to decide when to ask you before running a tool.
| Tool kind | Annotations | What your client does |
|---|---|---|
| Read tools | readOnlyHint: true, destructiveHint: false | Can run without asking. Nothing changes. |
| Tools that only add something new | destructiveHint: false | Creating a project, block, variant, rule, form field or material, or importing a library item. Existing data is never changed. Your client applies its normal write setting. |
| Tools that change or remove data | destructiveHint: true | Every update, delete, reorder, rename, move and assignment, every high-risk tool, and the workflow start, answer and control tools. Clients ask you before each call. |
The annotation decides whether your AI client asks. Separately, high-risk changes (pricing, SKUs, deletions, bulk edits, store links) never apply from the agent at all: they wait for approval in Simplio3D at /dashboard/ai-changes. Tools that reach a system outside Simplio3D (free texture sources, or your own Shopify or WooCommerce store) are marked openWorldHint: true, and so are the workflow start, answer and control tools, because the project builder workflow can read your Shopify store's product catalog. Every other tool is openWorldHint: false: it changes only your Simplio3D workspace. No tool can publish a project or change its share setting; when a project is already shared, its configurator page is served by Simplio3D and shows the saved project.
Each tool also states the one connection scope it needs, as securitySchemes: [{ "type": "oauth2", "scopes": ["pricing:read"] }] (also mirrored under _meta.securitySchemes). It is the same scope listed for that tool in the Tool Reference; a connection only sees the tools its granted scopes cover.
What every call passes through
- Authentication and billing. The same gates as the rest of the API: a verified account with an active plan or trial.
- Workspace scoping. Requests act on one workspace. Data is addressed by the authenticated account’s own keyspace, so an id belonging to another tenant simply resolves to “not found” — it can never cross the boundary.
- Per-tool permissions. Each tool declares the permission it requires — read tools a read permission, write tools a write permission — and is refused for workspace roles that lack it. A Viewer seat can never invoke or confirm a write.
- Schema validation. Arguments are validated before a tool runs; unknown fields are rejected rather than ignored.
- Result sanitization. Results are filtered before they reach the model: credential-shaped fields are redacted, oversized payloads are capped, and any truncation is marked so a model cannot mistake a partial answer for a complete one.
- Audit logging. Every execution is recorded with the tool name, account, workspace, duration, and outcome. Argument values and results are never logged.
Never exposed to a model
Project settings are additionally filtered through the same credential denylist used for public share links, and the tool reports which fields it withheld.
Operational advice
- Give agents a token from an account whose access matches the job — use a Viewer seat for read-only analysis rather than an owner token.
- Rotate the token if it may have been exposed; revoking the seat immediately stops all tool access.
- Remember that anything an agent reads may be sent to your AI provider. Treat customer quote requests accordingly.