When you connect an AI tool to Superhuman Docs through the Docs MCP, several controls decide what it can see and change: doc permissions, locking, and organization-level admin settings. This article explains how they fit together and which one to use.

Understand how the controls work together

The Docs MCP acts as you. Every request is checked against your own access when it runs, so a connected AI tool can’t reach a doc you can’t reach or make a change you couldn’t make yourself. The controls below work in layers:

• Doc permissions set what you (and so your AI tool) can do in a doc.

• Locking limits changes to pages and tables without changing anyone’s permission level.

• Admin settings decide whether the MCP and AI can be used at all, and by whom. These are available only on Enterprise.

Set doc permissions

The Docs MCP can only do what your access level allows. If you have Can view access level to a doc, the MCP can read the doc but can’t change any content. If you have Can edit access to a doc, the MCP can edit content in that doc - including deleting pages, rows, columns, and whole tables. Because Can edit includes changing table structure, use page locking if you need to separate editing data from restructuring tables.

Docs also inherit access from the folder they’re in. To learn about access levels and sharing options, see Share your doc and Create and share folders in Superhuman Docs.

Lock pages and tables

Superhuman Docs has two kinds of locking, and they offer different levels of protection. Locking is available on the Team and Enterprise plans, and managing locks requires the Doc Maker role.

Page locking

Page locking applies to everything on a page, including its tables. You can set a page to Read only, or to Interact only and choose which actions to allow. Once the page is locked, some users may still be able to unlock it and make changes. This depends on the Unlocking settings for the doc. By default, anyone with edit access to the doc can unlock a page. But it can also be configured so that only specific people can unlock the doc. Learn more about unlocking settings here.

When a page is locked this way, the Docs MCP has access to whatever you yourself have access to in the UI.

• If you’re able to unlock the page and make a change, then so can the MCP. You will first see a message in the MCP client, asking you to confirm that you want to unlock the page. Then you can proceed with edits after confirming.

• If you don’t have permission to unlock the page or take certain actions on the page, then neither can the MCP.

To set up page locking, see Add locking to the pages of your doc. Note that page locking isn’t available for table pages; refer to the Table locking section below instead.

Table locking

Table locking locks a single table and its connected views. It blocks adding, configuring, and deleting columns, as well as row changes (though the exact restrictions can be configured in the settings). It’s primarily designed as a guardrail against accidental edits. However, you cannot currently edit a locked table via the MCP. If you attempt to edit a locked table via the Docs MCP, you will be blocked from doing so.

To set up table locking, see Lock tables and views.

Manage MCP and AI access as an admin

Admins on the Docs Enterprise tier can control the MCP and AI at the organization level from the org admin settings. Available controls include…

• MCP personal access tokens: allow for all members, selected members, or no members.

• MCP OAuth: allow for all members, selected members, or no members.

• API tokens: allow for everyone, restrict to admins, or turn off entirely. Turning API tokens off also turns off the MCP for your organization.

• AI: turn on or off as an organization default, with per-workspace overrides.

For guidance on MCP authentication, scopes, and prompt injection, see Security recommendations for the Docs MCP. To learn more about Docs AI, see Using Docs AI.

Follow these recommendations

1. Share at the lowest level that works. Give Can view or Can comment to people who only need to read, and keep Can edit for people who need to change content.

2. Lock critical pages. Set them to Read only, or to Interact only with just the actions your team needs. This also protects the tables on those pages. Table locking can also be used to prevent changes via the MCP (but will not block changes from the user directly in the UI).

3. Choose who can unlock. Set specific doc admins in the Unlocking tab. Otherwise, anyone with edit access can unlock, and page locking won’t hold.

4. Match MCP and AI settings to how your team works. For example, limit MCP personal access tokens to selected members if most people should use OAuth. [Enterprise only.]

5. Use your AI tool’s confirmation prompts. Many AI tools can require your approval before deleting pages or making bulk changes to tables.

FAQs

Related resources

• Security recommendations for the Docs MCP

• Using the Superhuman Docs MCP