Permissions - Precisely Data Integrity Suite

Data Integrity Suite
Product
Spatial_Analytics
Data_Integration
Data_Enrichment
Data_Governance
Precisely_Data_Integrity_Suite
geo_addressing_1
Data_Observability
Data_Quality
dis_core_foundation
Services
Spatial Analytics
Data Integration
Data Enrichment
Data Governance
Geo Addressing
Data Observability
Data Quality
Core Foundation
ft:title
Data Integrity Suite
ft:locale
en-US
PublicationType
pt_product_guide
copyrightfirst
2000
copyrightlast
2026

This section describes the source-side permissions required for the AI Catalog connector to discover assets from each supported discovery source.

Note: The permission requirements described here are subject to change depending on the provider version, account configuration, and future platform updates.

MCP / AI Agent (self-hosted)

MCP servers do not have a formal permission model. The access required depends on how each server is protected.

Table 1.
Scenario What is needed
Open / internal network Network access from the connector to the MCP endpoint — no credentials required.
API Key protected An active API key with read access; no special role needed.
Bearer Token protected A valid token (JWT, PAT, or session token) that grants read access to the MCP introspection methods.
OAuth2 Client Credentials A client ID and secret that can obtain an access token from the token endpoint. The token must authorize MCP introspection calls.
OAuth2 Authorization Code A pre-issued long-lived refresh token for a user or service account with read access to the MCP server.
Basic Auth Username and password for an account with read access to the MCP server.

At minimum, the credential must allow the connector to call the following JSON-RPC methods on each configured endpoint:

  • POST /mcp with method initialize
  • POST /mcp with method tools/list
  • POST /mcp with method resources/list
  • POST /mcp with method prompts/list

For AI Agent discovery, the credential must also allow a GET request to reach one of the following well-known paths on each configured AI agent base URL:

  • <base>/.well-known/agent.json
  • <base>/.well-known/agent-card.json

Anthropic Claude

Table 2.
Permission Where Why
API Key (any active key) console.anthropic.com → API Keys Required to authenticate all Anthropic API calls.
Models API access Included with any API key Needed to call GET /v1/models. No extra permission required.
Managed Agents beta access Must be enabled on your Anthropic account Needed to call GET /v1/agents. Without this, the endpoint returns 403 and agent discovery is skipped. Contact Anthropic to request access if not available.
Note: No special organizational role is required. Any user or service account with an active API key has read access to models. Managed Agents is a beta feature (anthropic-beta: managed-agents-2026-04-01) and is subject to change.

OpenAI

Table 3.
Permission Where Why
API Key (any active key) platform.openai.com → API Keys Required for all OpenAI API calls.
Models read Included with any API key Calls GET /v1/models. No extra permission needed.
Assistants read Included with any API key Calls GET /v1/assistants. Only the assistants in your own account are visible.
Note: There is no project-level or organization-level RBAC for the models or Assistants read APIs — any valid API key is sufficient. Note that the Assistants API is deprecated by OpenAI and is scheduled for removal in August 2026.

GitHub Copilot

Table 4.
Permission Why Notes
read:org scope on PAT Allows GET /orgs/{org} to verify the organization exists. Required.
repo scope on PAT Required for full organization and repository API access. Required.
Enterprise admin role Allows GET /enterprises/{enterprise}/copilot/custom-agents to list enterprise custom agents. Optional. If the token owner is not an enterprise admin, custom agent discovery is skipped gracefully (403 is ignored).

To create a classic PAT with the required scopes:

  1. Go to GitHub → Settings → Developer settings → Personal access tokens → Tokens (classic).
  2. Click Generate new token.
  3. Select the repo and read:org scopes.
  4. Click Generate token and copy the value immediately.
Note: Fine-grained PATs do not support organization-level Copilot APIs. You must use a classic PAT. Create one connection per GitHub organization.

Microsoft Copilot Studio

The connector uses an Azure App Registration with application (service-to-service) permissions — no user sign-in is required at runtime.

Table 5.
Permission Type Where to Grant Why
CopilotPackages.Read.All Application (not Delegated) Azure Portal → App Registration → API permissions → Microsoft Graph Lists all Copilot Studio agents in the tenant.
Admin consent Required A Global Administrator or Privileged Role Administrator must click Grant admin consent. Application permissions require admin consent before they are active. Without it, all calls return 403.

To set up the Azure App Registration:

  1. Go to portal.azure.com → Microsoft Entra ID → App registrations.
  2. Click New registration, enter a name (for example, ai-catalog-connector), and click Register.
  3. Note the following values from the Overview page:
    • Directory (tenant) ID — use as the Azure Tenant ID field in the connector.
    • Application (client) ID — use as the Azure Client ID field in the connector.
  4. Go to API permissions → Add a permission → Microsoft Graph → Application permissions.
  5. Search for CopilotPackages, select CopilotPackages.Read.All, and click Add permissions.
  6. Click Grant admin consent for [your organization]. This step requires a Global Administrator.
  7. Go to Certificates & secrets → New client secret. Copy the Value immediately — use it as the Azure Client Secret field in the connector. This value cannot be retrieved after you navigate away.
Note:
  • CopilotPackages.Read.All is a read-only permission. The service principal can only read package metadata and cannot create, modify, or delete any Copilot Studio agents.
  • Create one connection per Azure AD tenant.
  • If an existing client secret value is lost, create a new one under Certificates & secrets.