Grooper MCP - Revision history

Dgreenwood: /* Isolate access by Grooper Repository and by identity */

2026-11-04T15:48:50Z

Isolate access by Grooper Repository and by identity

← Older revision		Revision as of 09:48, 4 November 2026
Line 611:		Line 611:
	'''By identity'''		'''By identity'''

	Understand that an agent acts as its operator. Grooper authenticates with Windows/Entra ID. There is no separate Grooper account system. When a user connects an AI client to Grooper MCP, the agent can do anything that user's account can do.		Understand that an agent acts as its operator. Grooper MCP authenticates with Windows or Entra ID. There is no separate Grooper account system. When a user connects an AI client to Grooper MCP, the agent can do anything that user's account can do.
			* If GWS uses anonymous authentication, the agent acts as the GWS App Pool's service user set in IIS.
			* If GWS uses OAuth authentication, the agent acts as user operating the AI client, using their Entra ID.
	*<li class="attn-bullet"> An administrator driving an agent has an administrator agent. Do not assume the agent is less privileged than you are.		*<li class="attn-bullet"> An administrator driving an agent has an administrator agent. Do not assume the agent is less privileged than you are.

Dgreenwood: /* Isolate access by Grooper Repository and by identity */

2026-11-04T15:44:31Z

Isolate access by Grooper Repository and by identity

← Older revision		Revision as of 09:44, 4 November 2026
Line 625:		Line 625:
	* If necessary, create a dedicated user or security group for agent-driven work, such as an "AI Agents" group. Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.		* If necessary, create a dedicated user or security group for agent-driven work, such as an "AI Agents" group. Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.
	* Watch for cumulative permissions: a user's effective rights are the union of every Permission Set that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.		* Watch for cumulative permissions: a user's effective rights are the union of every Permission Set that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.
	* Attribution caveat: When connecting via OAuth, the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log. When using anonymous authorization, the Event Log records actions under the GWS App Pool's service account in IIS.
	*<li class="attn-bullet"> Note: Permission Sets restrict MCP tools only when OAuth (Entra ID) authentication is configured. MCP is exposed through the Grooper Web Services (GWS) API set. GWS runs as an IIS application alongside Grooper that can authenticate with Windows, OAuth, or anonymous access. Under Windows authentication, standard AI clients cannot complete the IIS authentication handshake and receive 401. The MCP endpoint effectively fails closed rather than running unpermissioned. Do not treat that as a control. Configure GWS for OAuth, which is the only supported mode in which MCP tool related Permission Sets apply.		*<li class="attn-bullet"> Note: Permission Sets restrict MCP tools only when OAuth (Entra ID) authentication is configured. MCP is exposed through the Grooper Web Services (GWS) API set. GWS runs as an IIS application alongside Grooper that can authenticate with Windows, OAuth, or anonymous access. Under Windows authentication, standard AI clients cannot complete the IIS authentication handshake and receive 401. The MCP endpoint effectively fails closed rather than running unpermissioned. Do not treat that as a control. Configure GWS for OAuth, which is the only supported mode in which MCP tool related Permission Sets apply.

			Attribution caveat: When connecting via OAuth, the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log. When using anonymous authorization, the Event Log records actions under the GWS App Pool's service account in IIS.

	=== Use custom MCP Servers to instruct agents and restrict tool categories ===		=== Use custom MCP Servers to instruct agents and restrict tool categories ===

Dgreenwood: /* Isolate access by Grooper Repository and by identity */

2026-11-04T15:44:10Z

Isolate access by Grooper Repository and by identity

← Older revision		Revision as of 09:44, 4 November 2026
Line 625:		Line 625:
	* If necessary, create a dedicated user or security group for agent-driven work, such as an "AI Agents" group. Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.		* If necessary, create a dedicated user or security group for agent-driven work, such as an "AI Agents" group. Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.
	* Watch for cumulative permissions: a user's effective rights are the union of every Permission Set that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.		* Watch for cumulative permissions: a user's effective rights are the union of every Permission Set that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.
			* Attribution caveat: When connecting via OAuth, the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log. When using anonymous authorization, the Event Log records actions under the GWS App Pool's service account in IIS.
	*<li class="attn-bullet"> Note: Permission Sets restrict MCP tools only when OAuth (Entra ID) authentication is configured. MCP is exposed through the Grooper Web Services (GWS) API set. GWS runs as an IIS application alongside Grooper that can authenticate with Windows, OAuth, or anonymous access. Under Windows authentication, standard AI clients cannot complete the IIS authentication handshake and receive 401. The MCP endpoint effectively fails closed rather than running unpermissioned. Do not treat that as a control. Configure GWS for OAuth, which is the only supported mode in which MCP tool related Permission Sets apply.		*<li class="attn-bullet"> Note: Permission Sets restrict MCP tools only when OAuth (Entra ID) authentication is configured. MCP is exposed through the Grooper Web Services (GWS) API set. GWS runs as an IIS application alongside Grooper that can authenticate with Windows, OAuth, or anonymous access. Under Windows authentication, standard AI clients cannot complete the IIS authentication handshake and receive 401. The MCP endpoint effectively fails closed rather than running unpermissioned. Do not treat that as a control. Configure GWS for OAuth, which is the only supported mode in which MCP tool related Permission Sets apply.

	~~Attribution caveat: the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log.~~

	=== Use custom MCP Servers to instruct agents and restrict tool categories ===		=== Use custom MCP Servers to instruct agents and restrict tool categories ===

Dgreenwood: /* Best practices */

2026-11-04T15:41:01Z

Best practices

← Older revision		Revision as of 09:41, 4 November 2026
Line 573:		Line 573:

	'''Indirect routes to instability or confusing results'''		'''Indirect routes to instability or confusing results'''
	* '''Prompt injection''' - the content an agent processes is untrusted input. A document's text or a prompt or resource from an external MCP server can carry instructions that steer an agent with write access toward the actions above.		* '''Prompt injection''' - the content an agent processes is untrusted input. A document's text or a prompt or resource from an external MCP server can potentially carry instructions that steer an agent with write access toward the actions above.
	* '''Silent partial overwrite''' - a write that succeeds while dropping configuration the agent never read.		* '''Silent partial overwrite''' - a write that succeeds while dropping configuration the agent never read.
	* '''Stuck review work''' - claiming a review task and not closing it, which holds an exclusive lock other reviewers cannot take.		* '''Stuck review work''' - claiming a review task and not closing it, which holds an exclusive lock other reviewers cannot take.

Dgreenwood at 17:07, 3 November 2026

2026-11-03T17:07:44Z

← Older revision		Revision as of 11:07, 3 November 2026
Line 1:		Line 1:
			__NOINDEX__

	{{beta}}		{{beta}}

Dgreenwood: /* Isolate access by Grooper Repository and by identity */

2026-11-03T17:06:39Z

Isolate access by Grooper Repository and by identity

← Older revision		Revision as of 11:06, 3 November 2026
Line 623:		Line 623:
	* If necessary, create a dedicated user or security group for agent-driven work, such as an "AI Agents" group. Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.		* If necessary, create a dedicated user or security group for agent-driven work, such as an "AI Agents" group. Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.
	* Watch for cumulative permissions: a user's effective rights are the union of every Permission Set that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.		* Watch for cumulative permissions: a user's effective rights are the union of every Permission Set that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.
	*<li class="attn-bullet"> Note: Permission Sets restrict MCP tools only when OAuth (Entra ID) authentication is configured. MCP is exposed through the Grooper Web Services (GWS) API set. GWS runs as an IIS application alongside Grooper that can authenticate with Windows, OAuth, or anonymous access. Under Windows authentication, standard AI clients cannot complete the IIS authentication handshake and receive 401. The MCP endpoint effectively fails closed rather than running unpermissioned. Do not treat that as a control. Configure GWS for OAuth, which is the only supported mode in which Permission Sets apply.		*<li class="attn-bullet"> Note: Permission Sets restrict MCP tools only when OAuth (Entra ID) authentication is configured. MCP is exposed through the Grooper Web Services (GWS) API set. GWS runs as an IIS application alongside Grooper that can authenticate with Windows, OAuth, or anonymous access. Under Windows authentication, standard AI clients cannot complete the IIS authentication handshake and receive 401. The MCP endpoint effectively fails closed rather than running unpermissioned. Do not treat that as a control. Configure GWS for OAuth, which is the only supported mode in which MCP tool related Permission Sets apply.

	Attribution caveat: the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log.		Attribution caveat: the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log.

Dgreenwood: /* Isolate access by Grooper Repository and by identity */

2026-11-03T17:01:19Z

Isolate access by Grooper Repository and by identity

← Older revision		Revision as of 11:01, 3 November 2026
Line 623:		Line 623:
	* If necessary, create a dedicated user or security group for agent-driven work, such as an "AI Agents" group. Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.		* If necessary, create a dedicated user or security group for agent-driven work, such as an "AI Agents" group. Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.
	* Watch for cumulative permissions: a user's effective rights are the union of every Permission Set that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.		* Watch for cumulative permissions: a user's effective rights are the union of every Permission Set that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.
	*<li class="attn-bullet">Note: ~~Tool-level permissioning requires~~ OAuth (Entra ID) authentication. MCP is exposed through the Grooper Web Services (GWS) API set. GWS runs as an IIS application alongside Grooper that can authenticate with Windows, OAuth, or anonymous access~~. MCP permissioning is only enforced in OAuth mode~~. Under Windows authentication, ~~an agent sees every tool its~~ MCP ~~Server exposes regardless of Permission Sets~~. ~~Confirm your~~ GWS ~~is configured~~ for OAuth ~~before relying on any control~~ in ~~this section and never expose MCP from an anonymously authenticated GWS in production environments~~.		*<li class="attn-bullet"> Note: Permission Sets restrict MCP tools only when OAuth (Entra ID) authentication is configured. MCP is exposed through the Grooper Web Services (GWS) API set. GWS runs as an IIS application alongside Grooper that can authenticate with Windows, OAuth, or anonymous access. Under Windows authentication, standard AI clients cannot complete the IIS authentication handshake and receive 401. The MCP endpoint effectively fails closed rather than running unpermissioned. Do not treat that as a control. Configure GWS for OAuth, which is the only supported mode in which Permission Sets apply.

	Attribution caveat: the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log.		Attribution caveat: the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log.

Dgreenwood: /* Isolate access by Grooper Repository and by identity */

2026-11-03T16:52:22Z

Isolate access by Grooper Repository and by identity

← Older revision		Revision as of 10:52, 3 November 2026
Line 614:		Line 614:

	Grooper Permission Sets are your control surface here. A Permission Set applies to Windows or Entra ID users and groups, depending on how you are authenticating Grooper. Permission Sets restrict which pages, node types, and commands they can use. To constrain an agent:		Grooper Permission Sets are your control surface here. A Permission Set applies to Windows or Entra ID users and groups, depending on how you are authenticating Grooper. Permission Sets restrict which pages, node types, and commands they can use. To constrain an agent:
	*~~<li class="attn-bullet"> ''Beta note: Exactly how Permission Sets will be attributed to agents is still under development. You can assume this section to be generally true, but may change by release.~~		* Assign the user/group running the agent a restrictive Permission Set:
	* Create a dedicated user ~~or security~~ group ~~for~~ agent~~-driven work, such as an "AI Agents" group.~~		** Most importantly grant access only to the tools the agent should use.
	* Assign it a restrictive Permission Set: grant only the Page Access its role needs (for example, no Design access for a review or operations agent) and limit Node Permissions to the node types and commands the agent ~~legitimately requires~~.		** For additional safety, grant only the Page Access its role needs (for example, no Design access for a review or operations agent) and limit Node Permissions to the node types it should interact with and command-level permissions to the commands it requires.
	* Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.		* In most cases, you can assume a Grooper user's rights should be similar to the agent's rights. If the user can access the Design page, their agent should have broader access to tools than a user restricted to only the Batches page.
	* Watch for cumulative permissions: a user's effective rights are the union of every ~~permission set~~ that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.		** You still need to review tool access for each Permission Set.
			** Do not assume a Permission Set restricting users to the Batches page have a restricted tool set. You will need to curate the tool rights for each Permission Set.
			** Do not assume a Permission Set allowing Design page access should have an unrestricted tool set.
			* If necessary, create a dedicated user or security group for agent-driven work, such as an "AI Agents" group. Run the agent's Grooper session under that identity rather than your own, so its actions are checked against the restrictive set.
			* Watch for cumulative permissions: a user's effective rights are the union of every Permission Set that applies to them or their groups. A dedicated agent account is only safe if it is not also a member of any group that grants broader access.
			*<li class="attn-bullet">Note: Tool-level permissioning requires OAuth (Entra ID) authentication. MCP is exposed through the Grooper Web Services (GWS) API set. GWS runs as an IIS application alongside Grooper that can authenticate with Windows, OAuth, or anonymous access. MCP permissioning is only enforced in OAuth mode. Under Windows authentication, an agent sees every tool its MCP Server exposes regardless of Permission Sets. Confirm your GWS is configured for OAuth before relying on any control in this section and never expose MCP from an anonymously authenticated GWS in production environments.

	Attribution caveat: the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log.		Attribution caveat: the Event Log records actions under the connecting Windows account. When an agent operates as your own identity, its actions are indistinguishable from yours in the log.

Dgreenwood: /* Start in development environments */

2026-11-03T14:25:37Z

Start in development environments

← Older revision		Revision as of 08:25, 3 November 2026
Line 583:		Line 583:
	'''Beginners should only use MCP in development environments.'''		'''Beginners should only use MCP in development environments.'''

	Until you have experience with what AI agents can do with Grooper MCP, isolate their deployment to development Grooper ~~repositories~~.		Until you have experience with what AI agents can do with Grooper MCP, isolate their deployment to development Grooper Repositories.
	* This gives you the freedom to explore agent capabilities without interrupting production systems.		* This gives you the freedom to explore agent capabilities without interrupting production systems.
	* This works well with standard dev/test/prod deployments. Use MCP to create and configure resources in a dev environment, push those resources to a test environment to test them, and then either move them back to dev for further MCP-assisted development or promote them to the production environment.		* This works well with standard dev/test/prod deployments. Use MCP to create and configure resources in a dev environment, push those resources to a test environment to test them, and then either move them back to dev for further MCP-assisted development or promote them to the production environment.

Dgreenwood: /* Best practices */

2026-11-03T14:24:00Z

Best practices

← Older revision		Revision as of 08:24, 3 November 2026
Line 560:		Line 560:

	Specifically, consider the risks an agent can introduce:		Specifically, consider the risks an agent can introduce:

			'''Normal actions that may have unintended consequences'''
	* '''Data loss''' - deleting nodes, batches, or documents; overwriting configuration or content files.		* '''Data loss''' - deleting nodes, batches, or documents; overwriting configuration or content files.
			* '''Mass mutation''' - submitted jobs and commands can touch whole batches of documents at once. Furthermore, confirming fields marks invalid values as valid, hiding the very errors that would flag the damage.
	* '''Service disruption''' - stopping services or submitting work that alters live batches.		* '''Service disruption''' - stopping services or submitting work that alters live batches.
	* '''Remote code execution''' - some tool categories let an agent compile and run code on the Grooper server.		* '''Remote code execution''' - some tool categories let an agent compile and run code on the Grooper server.
	* '''Data exfiltration''' - exporting or uploading Grooper content and configuration to external systems.		* '''Data exfiltration''' - exporting or uploading Grooper content and configuration to external systems.
			* '''Credential pivot''' - Data Connections and CMIS Connections allow Grooper to interoperate with external systems, and other configurations such as Import Providers hold stored remote paths. Through these, an agent may reach systems beyond the Grooper Repository outside of the indented scope.
			* '''Unattended work''' - an agent schedules actions and job submissions that keep running (and keep spending) after the session.

			'''Indirect routes to instability or confusing results'''
			* '''Prompt injection''' - the content an agent processes is untrusted input. A document's text or a prompt or resource from an external MCP server can carry instructions that steer an agent with write access toward the actions above.
			* '''Silent partial overwrite''' - a write that succeeds while dropping configuration the agent never read.
			* '''Stuck review work''' - claiming a review task and not closing it, which holds an exclusive lock other reviewers cannot take.
			* '''Loss of the audit trail''' - deleting log events, jobs, or scheduled tasks removes the evidence you need to understand what happened.
			* '''Escaping the tool surface''' - the Grooper Command Console and database queries work even when tool categories are restricted, and an agent's host-side tools can bypass Grooper entirely.

	The practices below ~~reduce these risks,~~ ordered from the broadest controls (environment and identity isolation) down to per-agent tool restrictions.		Remember: An agent's privileges are its operator's privileges. An administrator driving an agent has an administrator agent. Every practice in the rest of this section exists to limit the damage from the risks above. The practices below are ordered from the broadest controls (environment and identity isolation) down to per-agent tool restrictions.

	=== Start in development environments ===		=== Start in development environments ===