Authentication & Access Management
Authentication method
Matia's MCP server authenticates with OAuth. Your client redirects you to sign in with your normal Matia account, and you approve the connection. The assistant is then issued a short-lived token scoped to your account, and there's no separate credential to create, paste, or rotate.
A connection is scoped to the Matia workspace your signed-in account belongs to. To reach a second workspace, connect again with an account in that workspace.
How MCP access maps to your roles
MCP introduces no new identity and no separate permission set. Your assistant acts as you, with exactly the roles you already hold, so anything you can't do in the Matia UI, you can't do over MCP either.
Two rules govern which tools you get:
- A tool needs every permission it declares. Some tools read across more than one product area, so holding one of the required roles isn't enough on its own.
- Tools you can't use are hidden, not broken. Your assistant is only offered the tools your roles allow, so an unavailable tool never fails mid-task. It simply isn't there to call.
For the roles themselves, see the Roles reference; for individual capabilities, see the Permissions reference.
What each role unlocks
Every role can browse the catalog and assets, so a baseline set of read tools is available to everyone in the workspace. Area roles add their own product; the tools that span areas need the matching combination.
| To use these tools | You need |
|---|---|
| Search the catalog, walk lineage, list child assets, tags, schema changes, and connections | Any role; catalog and asset browsing is available to everyone |
| Read integrations, connections, configured streams, sync runs, and reverse-ETL records | Integrations Viewer or higher |
| Read monitors and their measurement history | Observability Viewer or higher |
| Preview the downstream impact of a change | Integrations Viewer or higher |
| List workspace activity | Integrations Viewer or higher |
| Read the audit changelog of an integration or monitor | Integrations Viewer and Observability Viewer |
| Get full asset details, or a one-call workspace health summary | Integrations Viewer and Observability Viewer |
| Read data quality issues and their evidence | Global Viewer or Global Admin |
A Global role covers every area at once, so a Global Viewer sees all of the read tools above.
Asset details and workspace health read across the catalog, integrations, and observability together, so they need visibility into all three. If your assistant says it can't find those tools, this combination is usually why.
Write actions
Three tools change something in Matia. Each needs edit-level access in the matching area:
| Write action | You need |
|---|---|
| Enable or disable a monitor | Observability Editor or higher |
| Trigger, pause, or resume an integration | Integrations Editor or higher |
| Tag, certify, or describe an asset, or update an issue's status | Global Admin |
Every write is flagged to your client as a non-read-only action, so assistants that support confirmation prompts ask before running one. See Security & Responsible Use.
Viewing and revoking access
To disconnect an assistant, remove the Matia connector from that client's settings, the same place you added it in Getting Started. The token it holds is short-lived, so access ends as soon as the connection is removed.
Changing someone's roles takes effect on their next tool call: a removed role's tools stop being offered, and a newly granted role's tools appear. Removing a user from the workspace ends their MCP access along with the rest of their Matia access.
Matia doesn't yet expose a single admin view listing every MCP client connected across your workspace. To shut off MCP access for an entire workspace immediately, contact Matia Support and we can block it at the workspace level.