Governance and security
Workspace settings and limits that control what AI assistants can do through the Stacksync MCP
These controls apply to the shared Stacksync MCP connection for platform management and MCP Gateway. Workspace roles govern Stacksync resources; MCP Gateway Policies add controls for direct access to connected apps.
Workspace owners control what AI assistants can do in their workspace from the Settings tab of the MCP page in the Stacksync app. Other members can see the settings but not change them.
Workspace settings
| Setting | What it does | Default |
|---|---|---|
| Ask before every change | Every create, update, delete or run shows a preview of the change and runs only after the member selects Accept. Assistants that support MCP Apps display a review card; others ask the member to confirm in the chat. With the setting off, a change is still previewed when a guardrail needs the member's confirmation. | Off |
| Allow log access | Lets assistants read run logs and payloads to troubleshoot failures. | On |
An AI assistant can follow instructions it finds in the data it reads. For workspaces with production data, turn on Ask before every change and review each proposed change before you accept it.
MCP Gateway Policies
MCP Gateway Policies limit which apps, and which actions of each app, members' assistants can use directly, and carry the guardrails that limit what assistants can see and change in each app. Every workspace has a Default Policy, and workspace owners can add policies for specific users and groups in the MCP Gateway Policies tab. Learn more about MCP Gateway Policies.
MCP Activity Log
The MCP Activity Log records every call AI assistants make in the workspace: who made it and through which assistant, what it acted on, which MCP Gateway Policy decided it with the verdict of every policy evaluated, and how it ended. Workspace owners see the whole workspace; other members see their own activity. Learn more about the MCP Activity Log.
Rate limits
Each user and each workspace API key can make up to 120 tool calls per minute.