Agent Execution & MCP Control

Operators and approved MCP clients share one action plane. Read-only checks may auto-run; mutating work against acme-wks-01 still waits for human approval.

This guide is the Cohort 01 operator view of MCP and agent control: not a private protocol dump. Prefer least privilege, keep humans in the loop for consequential work, and use Actions as the review surface.

Prerequisites

An enrolled Acme Corp endpoint online under the Acme operator tenant (see Get Started).
A portal operator identity (or API key) with only the scopes you need.
Clear HITL defaults: four-eyes unless Governance intentionally allows self-elevate for a client environment.

Connect an MCP client

Typical options:

OAuth login: preferred for interactive clients such as Cursor.
Downloadable FlowRMM plugin: Installers ships a credential-free plugin archive for Codex, Cursor, and other Agent Plugins clients, stamped with this portal’s MCP URL.
API key headers: for scripts and automation; mint keys in Settings and store them outside chat logs.

MCP access needs at least one of: command.execute, monitor.read, runbook.autonomous, or actions.write.

Roles are not entitlements. Keys like automation.use, agentic.use, and packages.use are tenant licensing entitlements: what the plan includes. Roles are what an identity may do. An entitlement name is not grantable as a role (a bad grant is rejected). To run stored runbooks, the tenant needs the automation.use entitlement and the caller needs the matching roles.

What operators usually do with MCP

Fleet visibility: list endpoints, check vitals, find software (for example Chrome on Acme Corp devices).
Read-only verification: PowerShell/shell checks that do not change state (often with actions.execute).
Mutating commands: queue uninstalls, scripts, or package work for Approve & run (actions.write).
Reviewed runbooks: use runbook.autonomous only for steps policy already cleared as non-HITL; do not over-grant actions.execute just to unlock that path.
Optional visual check: screenshot/verification tools when your cohort environment enables them.

Example path: MCP queues a winget uninstall for an Acme Windows endpoint → a human Approves & runs on Actions → the agent executes → the timeline keeps the handoff.

Policy tiers (operator mental model)

Structurally safe reads may auto-execute when the token has execute authority.
Raw mutations and human-required request_* tools land on Actions for a person.
Reviewed observe / single-endpoint remediate_within_bounds steps may dispatch only when runbook policy and caller role agree.
Endpoint agent enforcement is defense in depth: portal approval is still the Cohort 01 accountability story.

Details for the approval UX live in Operator Actions & Human Approval. Remote session mechanics live in Remote Control & Interactive Console.

Troubleshooting (operator level)

Tool denied / missing scope: mint a key or role with the needed permission; do not widen to admin by default. Do not try to grant *.use entitlement keys as roles.
Pending forever: someone needs to Approve & run or Reject on Actions.
Endpoint offline: confirm check-in under Endpoints before retrying.

Internal smoke scripts and private PROTOCOL references stay out of this public guide.

Related guides

Want hands-on help evaluating Cohort 01? Book a demo or apply for Cohort 01.