# Permissions for AI apps

> Three things decide what an AI app may do with your scoco account: your role, what you allow when you connect, and the account's policy.

https://scoco.ai/en/docs/ai-permissions/

An AI app never gets more than you may do in scoco yourself. When you are done, you know what each permission allows, which role can have it and what the account's policy limits on top.

## Three limits

1. **Your role.** An app reads with your access. What your role does not see in scoco, the app does not see either.
2. **What you allow when you connect.** The page **Connect an AI tool** offers **Read only**, **Read & change** and **Customise …**, but only what your role and the policy permit. **Read only** is preselected, or exactly what the app asks for if that is less.
3. **The policy.** Owners and admins limit every connection of the account under **Settings › AI access**, including later.

When one of the three limits gets narrower, that applies at once, to existing connections too. If you get a role with more rights, the connection stays with what you allowed when you connected. Connect the app again to allow more.

An API key for developers does not act with your access but with the permissions chosen when it was created. It never reads transcripts.

## The permissions

### All roles

| Permission | Allows |
|---|---|
| `calls:read` | **View calls (summaries, outcomes)** |
| `transcripts:read` | **Read call transcripts** |
| `contacts:read` | **View contacts** |
| `appointments:read` | **View appointments** |

### Owner, Admin, Member

| Permission | Allows |
|---|---|
| `contacts:write` | **Create and change contacts** |

### Owner, Admin

| Permission | Allows |
|---|---|
| `assistant:read` | **View assistants and rules** |
| `assistant:write` | **Change assistants and rules** |
| `knowledge:read` | **View knowledge** |
| `knowledge:write` | **Change knowledge** |

### Owner

| Permission | Allows |
|---|---|
| `usage:read` | **View usage** |

Whoever may change may also read. Transcripts include the calls. Even with permission to change, no app applies a change itself: you apply each proposal yourself, in scoco.

## Never possible

Billing, the team, phone numbers, data deletion and security are out of reach for every app, with any permission. scoco's support cannot create a connection.

## Transcripts

Transcripts contain your callers' words. An app reads them only when an owner or admin switches on **Share call transcripts with AI tools** and the person allows them when connecting. The switch stays off until someone turns it on. It applies to new connections: to read transcripts in an app that is already connected, connect it again.

## Privacy

What an app reads goes to its provider. Check that this fits your data protection records. With **Highest level** and the transcript switch you decide what the account shares at all.

_Last checked: 30 October 2026_