Manage tool access

When you enable tools in Admin console → Platform → Tools, you can restrict access to specific users, departments, Glean groups, or identity provider (IdP) groups. Visibility scoping controls which tools users can invoke in Chat, select or configure in Agent Builder, and access through Glean MCP servers. It also applies to third-party MCP tools that Glean connects to as an MCP Host.

Visibility scoping does not restrict tool execution when an end user runs an already-shared agent. Shared-agent runtime remains subject to configured credentials and downstream permissions.

Two distinct access controls

Admin configurations control two entirely separate layers of access: who can use the tool versus who can build with it.

Setting	What it controls	Where to configure
Visibility scope	Dictates which end users can see and invoke the tool within Chat, Agent Builder, or Glean MCP servers	Admin console → Tools → Edit settings → Make available to
Role-based access	Dictates which admins and builders can view and add this tool when constructing an agent	Admin console → Tools → Manage role-based access

For builder-level access, see Managing tool access.

How visibility scoping works

By default, when you enable tools, they are available to everyone in your Glean workspace. You can restrict this to specific users, departments, Glean groups, or IdP groups.

The selected audience applies when users invoke a tool in Chat, select or configure it in Agent Builder, or access it through a Glean MCP server. This includes native tools and tools imported from third-party MCP servers.

Glean MCP server and Glean as an MCP Host

These terms describe two different connection patterns:

Term	What it means	How visibility scoping applies
Glean MCP server	Glean exposes Glean tools to an external MCP host, such as Cursor, Claude, or ChatGPT.	Users can access only the Glean tools included in their configured audience.
Glean as an MCP Host	Glean connects to a remote third-party MCP server and makes its tools available through Chat, Agent Builder, or Glean MCP servers.	The configured audience controls whether users can use the third-party tools on those surfaces. Users may also need to authorize the third-party service.

For more information about connecting third-party servers to Glean, see Connect remote MCP servers to Glean.

Prerequisites for IdP group audiences

Before you configure an IdP group as a tool audience:

• You need the admin or super admin role.
• Your organization must have group-based permissions enabled.
• The identity provider that contains the group must be configured and syncing groups to Glean.
• The group must already be available in Glean when you configure the tool.

The supported identity providers are:

• Azure AD (Microsoft 365)
• Google Groups (Google Workspace)
• Okta

See Group-based permissions for provider setup and limitations. The available provider and group options depend on your deployment.

Glean plugin

Tool visibility also applies when users invoke tools through the Glean plugins for Cursor, Claude Code, and Codex. The plugins don't bypass visibility settings, connector permissions, or connector data access rules. See Manage Glean plugin access and security.

Experience outside the visibility scope

If a user falls outside the visibility scope of a tool, the system behavior depends on the interface:

• In Glean Chat: The tool is hidden. It does not appear as an available tool, and Glean ignores explicit user requests to invoke it.
• In Agent Builder: The tool is unavailable, so the user cannot select or configure it while creating an agent.
• Through Glean MCP servers: The tool is not available to the user when they connect to Glean through an MCP host such as Cursor, Claude, or ChatGPT.

These restrictions do not affect tool execution when the user runs an already-shared agent.

Configure visibility scoping

1. Navigate to Glean Admin console.
2. Click Tools.
3. Click the tool you want to configure and navigate to the Configuration tab.
4. Click Edit settings under Enable tools.
5. Under Make tools visible for all or some teammates, select the surfaces where the tool should be available:
   • Agent
   • Chat
   • Glean MCP Server
6. Under Access, select the audience for the tool:
   • All teammates
   • A specific department
   • Specific teammates
   • A Glean group
   • An IdP group
7. If you selected a Glean group or IdP group, search for and select the group. You can add individual teammates and groups to the same audience when those options are available.
8. Click Save.

Saving the tool configuration updates its visibility scope immediately. Changes to IdP group membership take effect after Glean receives the next identity sync. Depending on the identity integration, membership changes can be near real time or take up to three hours. See Group-based permissions for sync details and the on-demand sync option.

What the audience controls

The audience setting controls availability in the following surfaces. It does not control tool execution in already-shared agents.

Surface	Result for a user in the selected audience
Chat	The user can invoke enabled native tools and third-party MCP tools connected to Glean.
Agent Builder	The user can select and configure enabled tools, including connected third-party MCP tools, when creating an agent.
Glean MCP server	The user can access enabled Glean tools, including tools from connected third-party MCP servers, through an external MCP host.

Recommended scoping by rollout stage

To ensure a secure and stable deployment, expand the visibility scope of your tool progressively using the following phased approach:

Stage	Recommended scope
Initial pilot	Specific users: limit to your test group or IT and ops team
Departmental rollout	Specific departments: for example, Engineering only for Jira tools
Full rollout	Everyone

Visibility scope and agent sharing

Visibility scoping determines whether a user can select or configure a tool when creating an agent. It does not prevent users outside the scope from executing the tool in an already-shared agent. Execution remains subject to configured credentials and downstream permissions.

Troubleshooting

If a user reports that a tool is available for some colleagues but not for them, check these four settings in order:

1. Visibility scope: the user's account, department, Glean group, or IdP group isn't included in the Make available to setting.
2. IdP group synchronization (IdP groups only): if the tool audience includes an IdP group and the user was recently added to or removed from that group, wait for the next identity sync or run an on-demand sync if available. See Group-based permissions.
3. Chat vs Agents toggle: the tool is enabled for Agent only, not Chat. See Enabling tools for Chat vs Agents.
4. Individual tool disabled: the specific tool they need is unchecked. See Per-tool enable/disable.

For questions and support, reach out to the Glean support team.