---
title: "MCP security model and role scopes — Lemwatch Help"
description: "MCP tokens inherit the calling member's role, further clamped by an optional role override. Writes require confirm. Admin actions require admin."
canonical: "https://lemwatch.com/help/mcp-security-scopes"
source: "https://lemwatch.com"
---

# MCP security model and role scopes

> MCP tokens inherit the calling member's role, further clamped by an optional role override. Writes require confirm. Admin actions require admin.

## Quick answer

 Effective role = min(member role, token role override). Read tools need viewer+, writes need member+ and confirm: true , and add_maintenance_window needs admin.

## Guardrails

- Tokens are org-scoped — never cross-tenant

- Every call re-validates the calling member's role

- Prompt-injection defense: writes require explicit confirm: true from the model

- Full audit trail in api_request_logs

## Where to find it in Lemwatch

 **Settings → MCP tokens → Role override** when issuing a token.

## How to lock a token down

- Issue a token with role override = viewer .

- Give it to your AI client for read-only workflows.

- Keep admin-capable tokens for humans only.

- Rotate quarterly.

## FAQ

### Can a token escalate its own role?

 No. Role override can only *reduce* privileges.

### What if a member is removed?

 All tokens they created continue to work (they're org-scoped), but you should revoke any they no longer need.

## Related

- Manage MCP tokens

- MCP tool catalog

- Roles and permissions


## Related

- [Help centre](https://lemwatch.com/help)
- [How do I create and revoke MCP tokens?](https://lemwatch.com/help/mcp-tokens-manage)
- [MCP tool catalog: everything Claude and ChatGPT can call](https://lemwatch.com/help/mcp-tool-catalog)
- [Team Roles & Permissions](https://lemwatch.com/help/team-roles)
- [What is Lemwatch Pulse?](https://lemwatch.com/help/pulse-overview)
- [How to read your Pulse scan report](https://lemwatch.com/help/pulse-scan-anatomy)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [What is the Lemwatch MCP server?](https://lemwatch.com/help/mcp-server-overview)