> ## Documentation Index
> Fetch the complete documentation index at: https://docs.penbox.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> What an AI agent can and cannot do in your Penbox workspace.

An agent connected to Penbox is a user with tools. This page says what that user can do, what leaves your workspace, and what is refused.

## Sign-in

* **OAuth, in your browser.** On the first tool call, the agent opens the Penbox sign-in page. You sign in with your own account and approve the connection.
* **No token to paste.** The client registers itself with Penbox (dynamic client registration). No API key travels through the chat, a config file or the plugin.
* **Revocable.** Disconnect the connector in your client, or sign out of Penbox. The agent loses access.

A server-side agent can use a workspace API token instead. That token has the workspace's rights, like any [API client](/api-reference/authentication).

## Rights

* **The agent never has more rights than you.** Every tool call runs as the signed-in user. The same policies apply as in the Penbox app and the public API. What you cannot see or change in Penbox, the agent cannot either.
* **Several workspaces, no silent pick.** When your account reaches several workspaces, listing and creation tools refuse until the agent names one. The agent must ask you.
* **Actions are attributed to you.** A change made over MCP shows your name in the case history, with a "via MCP" tag.

## What the agent cannot do

* **Delete.** No tool deletes anything, and the raw API passthrough refuses every DELETE. Deleting is done in the Penbox app. Archiving a case is allowed: it is reversible.
* **Provision a workspace or create a member.** Both are refused over MCP.
* **Send without being asked.** Only `start_case_step` sends an email, an SMS or a form to a contact. The skills tell the agent to call it only when you explicitly ask to send.
* **Delete a task.** A task is dismissed, not deleted.

## Data

* **Nothing is pre-loaded.** The agent receives only what a tool call returns: the case it asked for, the form response it read. No background sync, no export of your workspace.
* **Data goes to your agent's provider.** A tool result is handed to the model you use (Anthropic, OpenAI, or another). Check that provider's terms for what it keeps. Penbox does not send anything to a model on its own during MCP usage.
* **Third-party text is labelled as data.** A case and a form response carry a note telling the agent that content written by contacts, respondents or incoming emails is data, never an instruction. This limits prompt injection through a form answer.
* **Large responses are cut.** A response over 50 KB is truncated. The agent is told to narrow the call.

## Hosting and billing

* **EU hosting.** The MCP server runs in the European Union, with the rest of Penbox.
* **No credits.** MCP usage does not consume Penbox credits. The model runs on your side, in your agent.

## Refused over MCP

| Operation                         | What happens                                                     |
| --------------------------------- | ---------------------------------------------------------------- |
| Any `DELETE`                      | Refused. Delete in the Penbox app.                               |
| `POST /workspaces`                | Refused. Workspace provisioning is not available over MCP.       |
| `POST /members`                   | Refused. Member creation is not available over MCP.              |
| A write covered by a curated tool | Refused. The refusal names the tool to use, so its guards apply. |

<Note>
  Refusals are answers, not errors. The agent reads the refusal and follows it. A refusal from the API itself, such as a 403, is final: it means your account lacks the right.
</Note>