MCP Server Security: Permissions and Governance for AI Assistants
Connecting ChatGPT, Claude or Grok to business systems should not mean giving AI the keys to everything. The Noca MCP Server combines OAuth sign-in, four permission groups, per-tool approvals and full run history, under the TRAPS framework.
The Four Noca MCP Permission Groups
| Group | What it allows | Example tools |
|---|---|---|
| Builder | Build and configure apps, flows, bots and templates | create_app, add_node, validate_flow |
| Data read | Read records, runs and bot conversations | query_records, list_runs, get_run |
| Data write | Run published flows that change data | run_flow |
| Admin | Publish, restore and delete, with confirmation for destructive actions | publish_flow, restore_app_version, delete_app |
Turn on only the groups each team needs. Most business users need Data read and Data write; builders add Builder; Admin stays with a small group. See the full Noca MCP Server tools reference.
Security Controls
for AI Assistants
OAuth Sign-In
Assistants connect through OAuth to Noca, never with shared passwords.
Permission Groups
Builder, Data read, Data write and Admin are enabled separately.
Per-Tool Approvals
Set each tool to Always allow, Needs approval or Blocked in your assistant.
Confirm Destructive Actions
Delete and restore actions require explicit confirmation.
Run History
Every flow run is logged with status, trigger, timing and errors.
Recommended MCP Setup by Role
- Sales, finance and HR users: Data read and Data write, with run_flow set to Needs approval at first.
- Builders and operations: add Builder so the assistant can create and test flows and apps.
- Platform admins: Admin only, and keep publish and delete on Needs approval.
Connect from Claude, ChatGPT or Grok, and work with Salesforce, NetSuite and Priority data under the same controls.
More from the Noca MCP Server: Zendesk MCP Server · Dynamics 365 MCP Server · Priority MCP Server · monday.com MCP Server · HubSpot MCP Server · SAP Business One MCP Server · NetSuite MCP Server · Salesforce MCP Server · Build AI Chatbots With MCP · Workflow Automation With MCP · Generate Documents With AI and MCP · Build Apps and Forms With MCP · Grok MCP Server for Business · Claude MCP Server for Business · ChatGPT MCP Server for Business
The TRAPS Framework
Behind Every Action
One connected process, from the first input to the final record in your systems.
Known identities.
Every assistant session signs in with OAuth and acts as a known Noca user.
Least privilege.
Only the permission groups and tools you enable are available to the AI.
Every run logged.
Flow runs can be inspected step by step, like the builder debugger.
Data stays protected.
Data is encrypted in transit and at rest, with GDPR, CCPA and HIPAA-ready controls.
Guarded actions.
Publish and delete actions are Admin-only and destructive actions need confirmation.
Customer Stories: Noca MCP Server
ACS Motion Control Uses Claude MCP With Priority ERP
Supply chain planners work with live Priority delivery-plan data from Claude through the Noca MCP Server, alongside AI invoice processing into Priority ERP.
Noca products: Noca MCP Server, Noca Apps, AI Agent Builder
Connected systems: Priority ERP
Read the full ACS Motion Control story →
Connect Your AI Assistant to Noca Securely
Frequently Asked Questions
Is the Noca MCP Server secure?
Yes. Assistants sign in with OAuth, only the permission groups you enable are available, each tool can require approval, destructive actions need confirmation and every run is logged.
What are the Noca MCP permission groups?
Builder, Data read, Data write and Admin. Each group unlocks a set of tools and can be turned on or off separately.
Can I require approval before an AI runs a flow?
Yes. In your assistant, set run_flow or any other Noca tool to Needs approval, and the assistant will ask before each call.
Can an AI assistant delete my data?
Only if you grant the Admin group, and even then delete actions require explicit confirmation.
How do I audit what an assistant did?
Use run history in Noca, or the list_runs and get_run tools, to see each run with its trigger, timing, inputs and errors.
Which compliance standards does Noca follow?
Noca maintains an ISO 27001-certified ISMS and SOC 2 Type II controls and supports GDPR, CCPA and HIPAA requirements.