What each access scope covers

Read what each connection scope lets an AI client do before you grant it on the consent screen. Nothing is needed first; see Connecting Claude, ChatGPT or a coding agent for where you choose them.

Five areas, nine scopes

The scopes fall into five areas. Each area has a read half and a write half, and you grant them separately, so a client can read an area without changing anything in it. Cycle status & notifications is read-only and has no write half.

Area	Scope	What it covers
Workforce & pay structures	workforce:read	Employee records, showing only the fields your role can see; departments; custom attributes; pay bands; employee data imports and data-health checks.
Workforce & pay structures	workforce:write	Adding, correcting and removing employee records; creating, changing and removing departments, custom attributes and pay bands; running, approving or rejecting an employee data import.
Cycle administration	cycle_admin:read	Cycles and their configuration, budget allocations, who is excluded from a cycle and why, the merit matrix’s projected cost, launch readiness, and a live cycle’s summary.
Cycle administration	cycle_admin:write	Creating a cycle and configuring its timeline, funding pools, guardrails and merit matrix; setting budget allocations; adding and removing named exclusions; launching the cycle.
Planning & approvals	planning:read	The worksheets and rollups you can already see, their recommendations and approval status, an employee’s pay history, and your cycle home’s team section, with your own worksheet’s progress and merit budget.
Planning & approvals	planning:write	Entering recommendations with their reason codes and rationales, submitting a worksheet, approving or returning one, and the worksheet actions your role allows, such as applying the merit matrix.
Cycle status & notifications	status:read	Your cycle home and your notification feed, including marking a notification read.
Close & payroll handoff	payroll:read	Award letters, their previews and delivery status, and the payroll summary and exports.
Close & payroll handoff	payroll:write	Generating and sending award letters, and producing the payroll export.

Every scope stays inside your role

A scope never adds to what you can do. A client granted planning:write can approve only the worksheets you could approve yourself, and workforce:read shows only the fields your role can see. If a client asks for something outside its scopes, it is refused and told which scope it is missing, such as Missing scope: payroll:write.

Some actions sit outside every scope and stay in Mitratech Comp: managing members and roles, your workspace’s settings, moving a cycle to its next phase, finalizing or cancelling a cycle, and reading the audit trail. What an AI client can do in Mitratech Comp lists them.

Changing what a client has

The scopes are fixed when you approve the connection. To grant a client different ones, revoke it and connect it again; see Reviewing and revoking a connection.