> For the complete documentation index, see [llms.txt](https://developers.epiqai.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.epiqai.com/access-and-security/permissions-and-access.md). # Permissions and access If you cannot see it in Epiq AI, neither can Claude. * Each tool is gated by Epiq AI permissions. * Each request is authorized server-side before any Epiq AI data is returned. **Examples:** * Listing projects requires project access permissions. * Viewing documents requires collection access. Permission checks are performed server-side using your Epiq AI account. ### Epiq AI MCP does not bypass Epiq AI permissions Every request runs as the signed-in Okta user. Epiq AI MCP resolves that identity to an active, verified Epiq AI user and validates account membership before running any tools. Project-scoped tools additionally validate that the user has access to the requested case in the selected account. If the user cannot access a project or account in Epiq AI, Epiq AI MCP will not return that data. ### Okta-backed authentication The MCP service is configured as a protected resource. It advertises OAuth protected-resource metadata, identifies the Okta authorization server, and validates bearer access tokens on every request. Token validation checks the Okta token signature against the discovered JWKS endpoint and enforces issuer and audience. The OAuth Authorization Code flow with Okta is performed between the MCP client and Okta. The Epiq AI MCP server does not implement a separate authorization server or consent screen; it validates the resulting Okta access token as a resource server. ### Server-side account and case authorization After token validation, the server extracts the token email claim, resolves the matching active and verified Epiq AI user, and validates selected account membership. For tools with `case_id`, the MCP adapter checks the case permission table and confirms the case belongs to the selected account before invoking the tool body. Every request using Epiq AI MCP runs as the signed-in user, with that user's own Epiq AI permissions. There are no service accounts, no shared API keys, and no elevated tokens stored inside Claude. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://developers.epiqai.com/access-and-security/permissions-and-access.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.