Security and access
Read-only access
A permission level where the assistant can look at data but cannot change anything. The safest starting point for ad accounts, analytics and store data.
Read-only access lets an assistant look at data without changing anything: campaign performance, orders, traffic, email metrics, payment history. It is the right starting point for almost every MCP connection in e-commerce, because the most valuable early uses are reporting, audits and answering questions, none of which need write access.
How you get it depends on the server. Some are read-only by design, such as Google's Google Ads server. Some offer a read-only mode or flag. Many hosted servers inherit whatever role or scopes you grant at sign-in, so the read-only choice is made on the vendor's consent screen or in its user management. The directory lists each server's access level.
Read-only is not the same as harmless. The assistant still sees customer data and business figures, so privacy rules and data processing agreements apply, and a wrong reading can still drive a bad decision. It simply removes the class of mistakes that change live systems.