Every AI tool has a right of its own. That right is necessary but never sufficient: the user must also hold the ordinary functional right that belongs to the same act. Someone who may not create bookings cannot create them through AI either.
The chain
tool_use— the master switch. Without this right the tool list is empty.tool_<name>— one right per tool, so AI access can be granted tool by tool.- The functional right behind the tool (
entity_…oraction_…) — the very same right the screens use. - For rescheduling, changing and cancelling an existing reservation: the caller's one-time verification code.
Who holds these rights?
Nobody, by default. On a fresh install all tool rights sit in the MCP group. On an environment that was upgraded the rights do exist, but they belong to no group at all — deliberately: had they been handed out automatically, everyone who already holds the functional right would gain AI access to it overnight.
The license owner sets the group up in one go with the Set up MCP group button on Configuration → AI settings → Tools. After that, adding a user to the group is the only step left.
The AI widget and the phone assistant
Those two have no logged-in user, so there is nobody whose rights could be checked. A fixed list of visitor tools applies to that door instead: checking availability, booking, forms, events, verification, changing one's own reservation after a one-time code, and handing over to a colleague. The timesheet and billable tools are not on that list — those are staff data and there is no visitor question they answer.
tool_file_search
Search the knowledge base through AI.
tool_work_entry_list
Retrieve logged hours through AI.
tool_work_entry_create
Log hours through AI.
tool_work_activity_list
Retrieve the work activities through AI.
tool_timesheet_status
Retrieve the timesheet status through AI.
tool_billable_list
Retrieve billable lines through AI.
tool_billable_update
Change a billable line through AI.
