Every tool behind the operations door /mcpoperations has a right of its own. That right is necessary but never enough.
The chain
tool_operations_use— the master switch. Without this right the tool list is empty.tool_operations_<tool>— one right per tool. Plan and apply each have their own right.- The functional right behind the tool — the very same right the screen uses.
- For the heaviest actions: the plan issues a confirmation token that applying requires.
Who holds these rights?
The rights sit in the MCP-Operations group, together with the functional rights the tools need. A fresh install gets that group automatically; on an upgraded environment you set it up with the button on Configuration → AI settings → Tools. Either way the group starts without members. Nothing behind this door is public: without a logged-in user everything is refused.
What the tools do is described on MCP operations tools.
tool_operations_billable_list
Retrieve billable lines through AI.
tool_operations_billable_update_apply
Change a billable line through AI.
tool_operations_billable_update_plan
Show the intended change of an invoice line, including the amount, through AI.
tool_operations_booking_action_apply
Accept, reject or cancel a reservation through AI.
tool_operations_booking_action_plan
Show the intended accepting, rejecting or cancelling through AI.
tool_operations_booking_add_payment_apply
Register a payment on a reservation through AI.
tool_operations_booking_add_payment_plan
Show the intended payment, including the outstanding amount, through AI.
tool_operations_booking_change_participants_apply
Change the number of participants of a reservation through AI.
tool_operations_booking_change_participants_plan
Show the intended change of the number of participants, including the price, through AI.
tool_operations_booking_create_apply
Create a reservation through AI.
