> ## Documentation Index
> Fetch the complete documentation index at: https://docs.erdo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sharing a connection read-only

> Share a GitHub, CRM or other connection with your team so they can look things up through it, without being able to change anything in the connected app.

# Sharing a connection read-only

When you connect an app such as GitHub or Attio, Erdo uses your login to reach it. Sharing that
connection with your organization lets teammates use it too, through Erdo's agents. That is useful
for a team that needs to look things up in a repository or a CRM but has no reason to change it:
a sales team reading the product's code and pull requests, for example.

Shared connections are **read-only for teammates by default**. Teammates can search, list and read
through the connection. They cannot create, update, merge, push or delete anything in the connected
app. You, as the person who connected it, keep full access.

This applies to connections made with your own login: connected apps such as Attio or HubSpot, and
MCP servers such as GitHub. Connections your whole organization uses by design, such as Google Ads
or a data warehouse, work as they always have.

## Why the app's own permissions are not enough

Many apps cannot give Erdo a read-only grant. GitHub is the clearest case: its OAuth permission for
private repositories, `repo`, always includes write access, so a GitHub connection made with your
login can change anything your login can. If you are an organization admin on GitHub, that includes
merging into protected branches.

So Erdo enforces read-only access itself, on every path a teammate's request takes:

* Actions that change data are not offered to teammates on a read-only connection, and Erdo refuses
  them if one is requested anyway.
* Direct API requests made through the connection are limited to reads.
* The connection's access token is never handed to code a teammate's request runs, because code
  holding the token could write.
* For GitHub, Erdo also asks GitHub's own tool server to run in read-only mode, so GitHub refuses
  writes as well.

A teammate who asks for a change through a read-only connection gets a clear refusal naming the
connection's owner, who can make the change or give them full access.

## Sharing a connection

1. Open **Data → Connectors** and choose **Share** on the connection.
2. Under **General access**, choose your organization, or add specific people.
3. Under **What teammates can do**, leave **Read only** selected, or choose **Read and write** if
   teammates should be able to make changes through your login.

Only you, or an admin of your organization, can change what teammates can do.

> [!NOTE]
>
> Connections that were already shared with teammates before read-only sharing existed keep the access
> they had. Check **What teammates can do** on any shared connection to confirm it is set the way you
> want.

## From the CLI and the API

```bash CLI theme={null}
# Teammates can only read through this connection
erdo integrations member-access 90a8c2e0-943d-4993-9768-6b8e59170d9a read_only

# Teammates can also make changes through it
erdo integrations member-access 90a8c2e0-943d-4993-9768-6b8e59170d9a full
```

```bash REST theme={null}
curl -X POST -H "Authorization: Bearer $ERDO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"member_access": "read_only"}' \
  https://api.erdo.ai/v1/integrations/$INTEGRATION_ID/member-access
```

`GET /v1/integrations` and `erdo integrations list` report each connection's `member_access`.

There is deliberately no MCP tool for this setting. Deciding whether teammates can change data
through someone's login is a decision for a person, not for an agent.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.