Update Oauth Token

Change what an AI-assistant (MCP) connection may do (Manage connection): grants, one per business — organization_id null is your own account — each none, read or write, and new_organization_access, its default in a business you join later (none, read, or role: read and write where your role allows it, read only elsewhere). Applies at once; the connection stays live.

A grant can never exceed your own role in that business (owner, admin and manager can grant writes; contractor and viewer only reads); a 422 says which. A self-registered assistant is issued public read write and its grants are seeded at consent to match your role (read and write where you are an owner, admin or manager, read only elsewhere, read and write on your own account); what the grants say is what it can do, from its next request. A connection consented without write (made before 2026-10-09, or a client that asked for less) gains the scope with its first write grant and loses it with the last. Only the connection's own person may call this, and only for an mcp token. A connection made before grants existed gets its first grants seeded from your roles on the first update.