Permissions & write consent
Credential scope and current workspace role are checked together.
On this page
Two independent checks
A credential grants read or read-and-write capability for approved sites. Workspace membership and role determine what the credential owner can do there now. Write consent does not turn a viewer into an administrator, and administrator membership does not make a read-only key writable.
Role-sensitive operations
General reports need authorized site access. Funnels and goals require member access for changes. Site settings, integration credentials, API keys, sharing and team administration require elevated access as described by each tool. Site deletion requires owner access and exact domain confirmation.
Explicit consent
API keys default to read-only and OAuth defaults to read access. Changes require the corresponding checkbox during creation or authorization. A read credential cannot create a stronger write key. Agents should ask for the user's intended change before executing consequential actions, even with a technically writable connection.
Personal and workspace data
Saved Explore views and Ask Weeveo chats are private to their owner. Workspace member email addresses, integration administration and visitor privacy records have additional role checks. Multi-site credentials still enforce project boundaries on every call.
Browser-only security workflows
Password, email, MFA, passkeys, recovery codes, session management, account export/deletion and ownership transfer retain browser authentication and reauthentication. get_account_management provides the appropriate URLs; tools do not collect your password or bypass MFA.
Find exact constraints
Every tool reference includes the implemented description, required write capability and complete argument schema. Destructive operations may also require explicit confirmation arguments; do not omit those confirmations or substitute a different record.
Still looking for an answer? Try troubleshooting or get in touch.