Skip to main content
AI assistants are off in every company until an admin turns them on. While they are off, no employee can connect an assistant. Everything on this page happens in the admin console, under AI assistants.

​
Who can manage AI assistants

Admins with the ai_assistants.manage permission. The company admin role and the super admin have it. A custom role can’t be given it, because turning AI assistants off disconnects every employee’s assistant. An admin without it sees “You don’t have permission to manage AI assistants.” A connection never gives an admin’s assistant admin power. An admin who connects an assistant gets the same tools and the same view as any employee.

​
Turn AI assistants on

  1. Open AI assistants, then the Overview tab.
  2. Turn on Allow AI assistants.
  3. Share the MCP address with your employees. They paste it into their assistant, sign in to Workchats and approve. See Connect an AI assistant.
Who can connect: employees with an active account. Guests can’t connect. Staff on a second email domain connect like any employee, unless your company’s external access is on, which makes them guests.

​
Turn AI assistants off

Turn off Allow AI assistants. The confirmation says how many active connections will end. Turning it off disconnects all of them at once. Each assistant’s next request fails. Turning AI assistants on again brings no connection back. Employees connect again.

​
Choose the message label

Under Message label, pick:
  • Always label (the default): every message an assistant sends for an employee shows “via” and the assistant’s name.
  • Let employees choose: each employee decides for their own messages, with Label my AI-sent messages in Settings → Connected AI apps. See Drafts and the “via” label.

​
Connections

The Connections tab lists every active connection in your company, newest first: the employee, the client, read and write or read only, when it connected and when it was last used. Filter by employee or by client. Revoke disconnects one connection at once. The assistant’s next request fails. The employee can connect again, unless you also block the client.

​
Block a client

Each client has a block key, the part of its identity Workchats can check, shown beside its name: In Blocked clients, enter a block key and select Block. Blocking:
  • refuses that client for every employee, also when it registers again with a new client id
  • disconnects every active connection with that block key at once
Blocking local:claude.ai stops apps on employees’ computers that start a sign-in with Claude’s identity, and leaves Claude on the web allowed. Unblock lets employees connect the client again. Connections that the block ended stay ended. A client on a computer chooses its own name, and can lie about it. Its block key starts with local:, or is its own link scheme, so you can still tell that it runs on someone’s computer. If you don’t trust a client, block its key, or turn AI assistants off.

​
Activity

The Activity tab lists every tool call, and every connect, reconnect and revoke, by an assistant in your company, newest first. Each row has:
  • the time, the employee and the client
  • the tool or event, for example search_messages or send_draft
  • the type of item it acted on, when there is one
  • the result: OK, error, denied, not found or rate limited
Filter by employee, client, tool or event, result, and dates. The log never stores message text, file content, tool arguments or tool results, so it shows none.

​
Your own admin actions

Workchats records each change on this screen in your company’s audit log, one entry per change: A change that changes nothing, for example blocking a key that is already blocked, writes no entry.

​
Other things that end a connection

You don’t have to revoke these by hand: An employee’s own “log out of all devices” does not end their AI connections. They disconnect those in Settings → Connected AI apps.