Who may use which AI tool?

AI tools are open to nobody by default. That is not a setting somebody forgot: a tool may only run when the user holds the tool right and the ordinary functional right, and on an upgrade those tool rights are deliberately assigned to no group at all. This page shows how to put them in place in one go.

Why it is not on automatically

Had the tool rights been handed to everyone who already holds the functional right, then on the day of the upgrade every employee who may cancel a reservation could also have AI do it for them. That is a different decision from the first one, and it belongs to a person.

Setting the MCP group up

1. Log in as the license owner. Only the license owner (or Teqa support) can do this: nobody may hand out a right they do not hold themselves, and at that moment nobody holds these rights.
2. Go to Configuration → AI settings → Tools.
3. At the top you will find a block with the current state: whether the MCP group exists, how many tool rights it carries and how many users are in it.
4. Click Set up MCP group. The group is created if it does not exist yet and is given every tool right. Clicking twice does no harm — nothing changes the second time.
5. Then click Assign users to the group and put the colleagues who need to work through AI into it.

Step 5 is the actual act. After step 4 the rights exist, but nobody holds them.

Checking that it works

The tool console is on the same screen. Pick a tool there: a padlock means the current account may not run it, and the screen names exactly which right is missing. That is the same check the MCP endpoint and the internal agent perform, so what works here works there.

An external AI connector that receives an empty or short tool list is almost always this: the user behind the API key is not in the MCP group. It is a rights answer, not a fault.

Enabling or disabling individual tools

If you would rather not open everything up, remove individual tool_… rights from the MCP group, or make a group of your own holding only the tools you want to allow. Do not forget tool_use: without that master switch the list stays empty, even when every other tool right has been granted.