Skip to main content

C · The BASIC Stack

Control what your AI can do through Composio

Know which account the AI uses, what it can change, and how to stop it. That makes a connection useful for real work.

Product documentation checked . Account settings and availability can differ.

See the permission settings

Which product and account does this cover?

Personal Composio connections first, with a separate developer section. Settings differ between For You, Platform, and connected AI clients.

Composio For You and Connect
Personal connections in supported clients. Enhanced Control requires MCP elicitation support.
Composio Platform and developer sessions
SDK/API configuration and Platform features; separate from hosted personal settings.

What the permission settings mean

Provider access
Set or check: Review the account and permissions on the provider's consent screen.
Limit: Composio cannot grant access that the provider or your organization denies.
Connected account
Set or check: Identify the exact work or personal account before using it.
Limit: Connecting an app is not enough when several accounts exist.
Action approval
Set or check: Use supported approval controls and verify that a denied action does not run.
Limit: A connection does not automatically mean every write requires confirmation.
Developer session
Set or check: Restrict allowed toolkits, tools, accounts, and approvals in the session.
Limit: Session policy does not govern unrelated browser access or other execution paths.

Which Composio product am I using?

For You connects personal tools to supported AI clients. Platform provides developer projects, authentication settings, sessions, and logs. Their configuration does not automatically carry between surfaces.

How do I connect one useful account?

Start with one task and one connection. Use Composio Connect for a supported MCP client, or the native Composio plugin where recommended.

  1. Connect Composio through your client's supported integration flow.
  2. Request the particular app connection you need. Complete its authorization in the provider's browser window.
  3. Check the signed-in account and requested permissions before accepting.
  4. Ask the assistant to list connection names and account identities without credentials. Identify the intended account in your next request.

Where do I set approvals without writing code?

For You documents Enhanced Control under Settings → General. Its approval flow depends on the connected client supporting MCP elicitation: the protocol for requesting a decision during tool use. Check that support and test the actual prompt. If it is unavailable, use a supported client or keep the task to reading and drafting in chat.

Check the AI client's approval controls separately. Enabling a connection does not mean every action asks first.

What does the provider still control?

OAuth scopes describe permissions granted by services such as Google or GitHub. Resource sharing and organization policies also matter. In Platform, an auth config defines authentication settings; a connected account is the resulting authorized identity. Tightening configured OAuth scopes affects new connections, so existing accounts need reauthorization. API-key connections do not use OAuth scope selectors.

For builders: enforce the policy in the session

Use positive toolkit and tool allowlists, a stable user identity, and an explicit account selection when identity matters. These session filters restrict execution as well as discovery. Preloading a tool schema is different from authorizing it. Use the session execution path for session-governed work.

Composio's experimental require_approval settings can gate named tools. Prefer explicit names for consequential actions: read/write tags are best-effort classifications. Supported MCP clients show approval requests; unsupported clients deny them by default. Keep that behavior.

Composio can miss tool calls inside its remote Workbench or bash tools. When approval must never be skipped, turn off the Composio Workbench execution feature for that session with sandbox.enable set to false. This removes those execution tools; keep your operating-system and coding-agent security sandboxes enabled. Its SDK framework handle_tool_calls helpers do not implement approvals; use session.execute. Always approve lasts for that tool and account within the session. Saved configuration changes also need applying to existing sessions.

How do I check the result and stop access?

Platform users can inspect Logs and correlate the action, account, session, status, and result. Hosted users should inspect the client's available activity and the source application's history. A successful tool response is a starting point; confirm the actual document or record.

Stop dependent runs, then remove or disable the intended connection. Platform's explicit revoke operation attempts upstream revocation, but provider support varies. Verify removal in the provider's connected-app settings too. Removing access does not erase earlier chat results or copied data.

Practice with fictional material

Prove one read and one approval boundary

Use a disposable document with invented details. Keep production material and real recipients out of the test.

  1. Confirm the connected account, then ask for one fact from the test document.
  2. Check whether this client supports Enhanced Control (MCP elicitation) or another approval control. If it does not, skip the edit and keep the output in chat.
  3. If supported, enable the approval control, request a harmless edit to the disposable document, and decline it.
  4. If you tested an edit, open the document directly and inspect its revision history.
  5. Record the account, granted access, tested action, outcome, and review date.

Check the evidence

  • The retrieved fact came from the intended account.
  • If tested, the declined edit did not happen.
  • You can identify where to disable the connection and revoke its provider access.
Save the results in your permission record

Common questions

Does removing a session disconnect the account?

No. Session deletion does not delete connected accounts. Review and remove the connection separately.

Is saying 'ask before making changes' enough?

Use that instruction to describe your intent, then configure an available permission or approval control and test it. The instruction alone does not reduce provider permissions.

Official sources

These instructions were checked against product documentation on October 31, 2026. The practice exercise is a suggested test for your own permitted workspace, not a claim that these controls were configured in your account.

Keep the whole workflow in view.

Set permissions for the tools you use.

Start with the overview, then follow the guide for your assistant or connection. Check what it can read, what it can change, and where approval happens.

Read the Controls overview
Return to Controls in the BASIC Stack

The manual is free

Build a system you can put to work.

Get the free AIOS book and practical guidance through The AI Enterprise.

Free. No credit card. Includes The AI Enterprise newsletter. Your download is yours to keep, and you can unsubscribe anytime.