Skip to main content

​
Sharing a connection read-only

When you connect an app such as GitHub or Attio, Erdo uses your login to reach it. Sharing that connection with your organization lets teammates use it too, through Erdo’s agents. That is useful for a team that needs to look things up in a repository or a CRM but has no reason to change it: a sales team reading the product’s code and pull requests, for example. Shared connections are read-only for teammates by default. Teammates can search, list and read through the connection. They cannot create, update, merge, push or delete anything in the connected app. You, as the person who connected it, keep full access. This applies to connections made with your own login: connected apps such as Attio or HubSpot, and MCP servers such as GitHub. Connections your whole organization uses by design, such as Google Ads or a data warehouse, work as they always have.

​
Why the app’s own permissions are not enough

Many apps cannot give Erdo a read-only grant. GitHub is the clearest case: its OAuth permission for private repositories, repo, always includes write access, so a GitHub connection made with your login can change anything your login can. If you are an organization admin on GitHub, that includes merging into protected branches. So Erdo enforces read-only access itself, on every path a teammate’s request takes:
  • Actions that change data are not offered to teammates on a read-only connection, and Erdo refuses them if one is requested anyway.
  • Direct API requests made through the connection are limited to reads.
  • The connection’s access token is never handed to code a teammate’s request runs, because code holding the token could write.
  • For GitHub, Erdo also asks GitHub’s own tool server to run in read-only mode, so GitHub refuses writes as well.
A teammate who asks for a change through a read-only connection gets a clear refusal naming the connection’s owner, who can make the change or give them full access.

​
Sharing a connection

  1. Open Data → Connectors and choose Share on the connection.
  2. Under General access, choose your organization, or add specific people.
  3. Under What teammates can do, leave Read only selected, or choose Read and write if teammates should be able to make changes through your login.
Only you, or an admin of your organization, can change what teammates can do.
Connections that were already shared with teammates before read-only sharing existed keep the access they had. Check What teammates can do on any shared connection to confirm it is set the way you want.

​
From the CLI and the API

GET /v1/integrations and erdo integrations list report each connection’s member_access. There is deliberately no MCP tool for this setting. Deciding whether teammates can change data through someone’s login is a decision for a person, not for an agent.