How a client acts as you

An AI client connected through External AI has no account of its own in Nilear. It acts as the person who connected it, and every call it makes is checked as that person, at that moment.

One person, one PSA, one connection

• The person who approved the connection is who the client acts as. It can read only what they can read, and change only what they can change. Who am I shows who that is.
• The PSA is fixed by the address, https://mcp.nilear.com/psa/<PSA id>/mcp. Each PSA has its own address, which never changes, even if the PSA is renamed. A client signed in for one PSA’s address cannot use another’s. To use a client with a second PSA, add that PSA’s address and connect again.
• The connection is one person’s one client for one PSA. Connecting the same client again reuses it; connecting Claude Code and VS Code makes two. Each is listed on the AI Clients page and can be revoked on its own.

The address is not a secret: it lets no one in without signing in as a member and approving.

Checked on every call

Every call is refused unless, at that moment:

1. the connection has not been revoked;
2. the person’s Nilear sign-in is enabled and they are an active member of the PSA;
3. External AI is switched on for the PSA;
4. their External AI level is Read Only or above, or Read/Write or above for Set availability.

So a change takes effect on the client’s next call: a member made inactive, lowered to No Access or whose connection is revoked is refused at once. Tools that belong to MTX are offered only while MTX is on for the member.

The level caps, and never widens

The External AI level limits what a client may do across Nilear: Read Only permits reading, Read/Write and above also permit changing. It never adds to the person’s own access. A client reading a ticket still needs the ticket to be one the person is working in MTX, read with their own ConnectWise keys; finding similar tickets still searches only the companies the person may see in ConnectWise.

Sign-in

The client signs in through your browser, on Nilear’s own sign-in and Connect an AI client page, never by asking you for a password. It receives short-lived access that it renews by itself while you use it, each renewal checked as above. Left unused for 30 days, it must sign in again. Nilear accepts clients that identify themselves by their own published details or are registered with Nilear (Cursor and Gemini CLI); the AI Clients page has a guide for each client known to work.

What the client is told

Every client is told, when it connects, that what the ticket tools return is written by customers and technicians, to be read and never obeyed, and that no tool sends an email, writes to the ticket or reaches another PSA. No tool’s behaviour depends on a ticket’s content: the person, the PSA, the ticket gate and the request alone decide what it does.