manage_permissions
Shares the spreadsheet (Drive permissions on the file — the OAuth token needs a Drive scope; the spreadsheets scope alone gets 403 here while every Sheets tool still works). action=list shows who has access: id, type, role, emailAddress/domain per permission; one page per call (shared-drive files...
This record as markdown: /tools/a1-x-tech-mcp-google-sheets/manage-permissions.md
What manage_permissions does on Mcp Google Sheets
AI agents use manage_permissions to create or update resources in Mcp Google Sheets, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Mcp Google Sheets environment.
| Parameter | Type | Required | Description |
|---|---|---|---|
role | string | — | grant/update: the access level to give. |
type | string | — | grant: who the grantee is. |
action | string | Yes | What to do with the file's permissions. |
domain | string | — | grant (domain): the domain, e.g. "example.com". |
page_size | integer | — | list: max permissions per page (1..100; shared-drive files default to 100). |
page_token | string | — | list: nextPageToken from the previous page. |
email_address | string | — | grant (user/group): the grantee's email. |
email_message | string | — | grant: custom text for the notification email. |
permission_id | string | — | update/revoke: the permission's id from action=list (or the grant reply). |
spreadsheet_id | string | Yes | The spreadsheet id — the long id from the URL (docs.google.com/spreadsheets/d/<spreadsheetId>/edit) or from create_spreadsheet / search_spreadsheets output. |
allow_file_discovery | boolean | — | grant (domain/anyone): let the file appear in search results (default false). |
send_notification_email | boolean | — | grant: send the standard sharing notification (default true for users/groups). |
Parameters from the server's own tool schema.
Why manage_permissions is rated Medium
Modifies access permissions reversibly; high impact on data confidentiality and sharing.
From the tool's definition Shares spreadsheet, grants role reader/commenter/writer, makes link public
Risk signalsHigh parameter count (12 properties) · Bulk/mass operation — affects multiple targets
Attacks that exploit this kind of access
The rule that runs manage_permissions safely
PolicyLayer is an MCP gateway: it sits between your AI agents and Mcp Google Sheets, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For manage_permissions, this is the rule to start with:
manage_permissions stays usable, but capped: an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.
The button opens the PolicyLayer dashboard: create your workspace, connect Mcp Google Sheets, apply this rule, and every manage_permissions call is checked against it from then on.
Questions about manage_permissions
Shares the spreadsheet (Drive permissions on the file — the OAuth token needs a Drive scope; the spreadsheets scope alone gets 403 here while every Sheets tool still works). action=list shows who has access: id, type, role, emailAddress/domain per permission; one page per call (shared-drive files cap a page at 100) — when the reply carries nextPageToken, pass it back as page_token for the rest. action=grant gives role reader/commenter/writer to type user/group (email_address required), domain (domain required, e.g. "example.com") or anyone (makes the link public — use deliberately); send_notification_email (default true for users) and email_message control the notification, allow_file_discovery lets domain/anyone grants surface in search. action=update changes an existing permission's role (permission_id + role). action=revoke removes a permission (permission_id) — the person loses access immediately. Ownership transfer is not supported by this server. Protecting individual ranges from co-editors is manage_protected_ranges, not this tool. It is categorised as a Write tool in the Mcp Google Sheets MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
manage_permissions accepts 12 parameters: role, type, action, domain, page_size, page_token, email_address, email_message, permission_id, spreadsheet_id, allow_file_discovery, send_notification_email. Required: action, spreadsheet_id. The full parameter table on this page comes from the server's own tool schema.
Register the Mcp Google Sheets MCP server in PolicyLayer and add a rule for manage_permissions: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Mcp Google Sheets. Nothing to install.
manage_permissions is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the manage_permissions rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for manage_permissions. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
manage_permissions is provided by the Mcp Google Sheets MCP server (@a1-x-tech/mcp-google-sheets). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
More on Mcp Google Sheets, and thousands of servers like it.
This server
Across the catalogue