> ## Documentation Index > Fetch the complete documentation index at: https://developers.workchats.com/llms.txt > Use this file to discover all available pages before exploring further. # For company admins > Turn AI assistants on, see and revoke connections, block clients and read the activity log AI assistants are **off** in every company until an admin turns them on. While they are off, no employee can connect an assistant. Everything on this page happens in the admin console, under **AI assistants**. | | Dev | Staging | Production | | - | - | - | - | | Admin console | `https://admin.dev.workchats.com` | `https://admin.staging.workchats.com` | `https://admin.workchats.com` | ## Who can manage AI assistants Admins with the `ai_assistants.manage` permission. The company `admin` role and the super admin have it. A custom role can't be given it, because turning AI assistants off disconnects every employee's assistant. An admin without it sees "You don't have permission to manage AI assistants." A connection never gives an admin's assistant admin power. An admin who connects an assistant gets the same tools and the same view as any employee. ## Turn AI assistants on 1. Open **AI assistants**, then the **Overview** tab. 2. Turn on **Allow AI assistants**. 3. Share the **MCP address** with your employees. They paste it into their assistant, sign in to Workchats and approve. See [Connect an AI assistant](/mcp/connect). Who can connect: employees with an active account. Guests can't connect. Staff on a second email domain connect like any employee, unless your company's external access is on, which makes them guests. ## Turn AI assistants off Turn off **Allow AI assistants**. The confirmation says how many active connections will end. Turning it off disconnects all of them at once. Each assistant's next request fails. Turning AI assistants on again brings no connection back. Employees connect again. ## Choose the message label Under **Message label**, pick: * **Always label** (the default): every message an assistant sends for an employee shows "via" and the assistant's name. * **Let employees choose**: each employee decides for their own messages, with **Label my AI-sent messages** in **Settings → Connected AI apps**. See [Drafts and the "via" label](/mcp/drafts#the-label-on-sent-messages). ## Connections The **Connections** tab lists every active connection in your company, newest first: the employee, the client, read and write or read only, when it connected and when it was last used. Filter by employee or by client. **Revoke** disconnects one connection at once. The assistant's next request fails. The employee can connect again, unless you also block the client. ## Block a client Each client has a **block key**, the part of its identity Workchats can check, shown beside its name: | Client | Example block key | | - | - | | Claude on the web | `claude.ai` | | ChatGPT | `chatgpt.com` | | An app on a computer that uses a web client's identity | `local:claude.ai` | | An app on a computer that registered itself | `local:claude code` | | An editor that opens its own links | `cursor`, `vscode` | In **Blocked clients**, enter a block key and select **Block**. Blocking: * refuses that client for every employee, also when it registers again with a new client id * disconnects every active connection with that block key at once Blocking `local:claude.ai` stops apps on employees' computers that start a sign-in with Claude's identity, and leaves Claude on the web allowed. **Unblock** lets employees connect the client again. Connections that the block ended stay ended. A client on a computer chooses its own name, and can lie about it. Its block key starts with `local:`, or is its own link scheme, so you can still tell that it runs on someone's computer. If you don't trust a client, block its key, or turn AI assistants off. ## Activity The **Activity** tab lists every tool call, and every connect, reconnect and revoke, by an assistant in your company, newest first. Each row has: * the time, the employee and the client * the tool or event, for example `search_messages` or `send_draft` * the type of item it acted on, when there is one * the result: OK, error, denied, not found or rate limited Filter by employee, client, tool or event, result, and dates. The log never stores message text, file content, tool arguments or tool results, so it shows none. ## Your own admin actions Workchats records each change on this screen in your company's audit log, one entry per change: | Action | Audit entry | | - | - | | Turn AI assistants on | `mcp.enabled` | | Turn AI assistants off | `mcp.disabled` | | Change the message label | `mcp.label_policy_changed` | | Revoke a connection | `mcp.connection_revoked` | | Block a client | `mcp.client_blocked` | | Unblock a client | `mcp.client_unblocked` | A change that changes nothing, for example blocking a key that is already blocked, writes no entry. ## Other things that end a connection You don't have to revoke these by hand: | When | What ends | | - | - | | You deactivate or remove an employee | All their connections | | You force-log-out an employee | All their connections | | An employee stops being an employee, for example becomes a guest | Their connections stop working at the next request | | Your company's maximum session lifetime passes | That connection | | An assistant is unused for 30 days | That connection | An employee's own "log out of all devices" does not end their AI connections. They disconnect those in **Settings → Connected AI apps**. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.