> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.moveworks.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moveworks.com/_mcp/server.

# Connectors and Access

Connectors hold the credentials and base configuration for backend systems such as Workday, Okta, and finance APIs. Running anything that uses a connector can call that system. For that reason, connectors do not follow the standard folder defaults. They are closed by default.

## Connectors Are Closed by Default

Most assets inherit their folder's access. Connectors are the exception. A new connector starts limited to its creator and admins.

<table>
  <thead>
    <tr>
      <th>
        Rule
      </th>

      <th>
        Behavior
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        <strong>Default access on creation</strong>
      </td>

      <td>
        The creator and admins only. Not visible to other users until an admin moves it.
      </td>
    </tr>

    <tr>
      <td>
        <strong>Where developers can publish</strong>
      </td>

      <td>
        Their Personal folder, or any custom folder where they hold 

        <code>Edit</code>

        . Not Public.
      </td>
    </tr>

    <tr>
      <td>
        <strong>Getting a connector into Public</strong>
      </td>

      <td>
        Admins only. A developer can request the move; an admin approves it.
      </td>
    </tr>

    <tr>
      <td>
        <strong>Folder assignment</strong>
      </td>

      <td>
        A connector lives in exactly one folder.
      </td>
    </tr>
  </tbody>
</table>

Public means org-wide access to the connector. Developers can create connectors and publish them to their Personal or custom folders, but moving a connector to Public requires an admin.

### Getting a Connector into Public

If you're a developer and you need a connector available org-wide:

Build it from the HTTP Action editor or the HTTP Connector app. It lands in your Personal folder as a draft, or in a custom folder where you have `Edit`.

Ask an admin to move the connector to Public. Admins see all connectors in the Connectors view.

The admin places the connector in Public, and it becomes usable across the workspace.

## Dependency-Aware Execution

You can only run an asset if you have `Use` on its entire dependency chain.

Running or testing a plugin requires `Use` on:

* the plugin itself,
* every action it calls, and
* every connector those actions use.

```mermaid
graph LR
    P[Plugin] --> A[Action] --> C[Workday Connector]
    style C fill:#fde68a,stroke:#b45309
```

If the Workday connector in that chain is scoped to an HR-only custom folder, no one outside that folder can run the plugin or the action, regardless of where the plugin lives. The connector's restriction propagates up the chain.

A plugin can be broadly available while the connector stays restricted.

A developer can have `Edit` on an action that calls a restricted connector. They can read and improve the logic, but they cannot execute it unless they also have `Use` on the connector.

## When a Dependency Is Restricted

If you try to reference or run an asset whose dependency you lack `Use` on, the dependency shows as locked in the editor, with a prompt to contact the owner. The UI shows the missing asset and permission.

## Connectors View

Admins get a **Connectors view** with every connector in the workspace, regardless of folder. Use it to review and place connectors. Developers do not get this view. Their access to a connector is still governed by folder and item-level permissions.

## Built-In Connectors

Built-in connectors, such as Okta and ServiceNow, have an extra layer of control. A workspace-level security setting determines whether they are available in Agent Studio. When enabled, built-in connectors arrive unassigned and cannot be used by developers yet. An Agent Studio admin places the connector into a folder from the Connectors view. After that, it follows the same folder and item-level rules as any other connector.

An MCP server is a connection to a remote MCP-compatible server. MCP servers do not live in folders and do not use per-asset roles. They appear under views in the sidebar and are governed at the server level. An admin decides which servers exist and who can reach them. The server controls which tools a user sees. Only Agent Studio admins can add MCP servers.

## Related

How standard assets inherit folder access, and why connectors don't.

What Use grants, and why it's independent of editing.