Every AI client connected to Soontra operates inside a scope model: a set of named permissions that decide what it can see and what it can change. Scopes apply whether the client connected with a sign-in or an API key, and they're enforced on every single tool call.
The design principle is simple: an external AI should be able to do useful work, but never anything you can't undo.
The scope model
When you create an API key you choose its scopes with per-scope checkboxes; OAuth grants carry scopes from the consent you approve. A client's effective access is exactly its granted scopes — no tool can reach beyond them.
Scope-by-scope breakdown
- read — always on. Projects, posts, comments, and Drive metadata.
- content — file text, transcripts, and summaries of indexed files.
- analytics — cached stats only.
- directory — teammate names and roles.
- write — create and update projects, documents, post drafts, and comments. Write never publishes or deletes.
- destructive — exists in the model but is not grantable today.
Write means drafts only
The write scope is deliberately shaped so an AI can prepare work, not ship it. A connected client can draft a post, but the draft lands in Soontra for a human to review and publish. It can create and update projects, documents, and comments — all reversible, all visible in the app.
What's never grantable
Publishing, deleting, and every other irreversible action sit outside the grantable scope set entirely. The destructive scope exists as a placeholder in the model, but nothing can be granted against it today — there is no checkbox to tick and no consent that includes it.
Rate limits and quotas
Connected clients share sensible quotas per workspace:
- 500 writes per day.
- 5,000 reads per day.
- 60 mutations per minute.
- Uploads up to 5 MB.
The audit trail
Every action a connected AI takes is audit-logged — which client, which tool, and what it touched. If something in your workspace changed and you want to know why, the trail answers it.
Automatic revocation
Access is tied to your role. If you lose your owner or admin role in a workspace, your API keys and OAuth grants are revoked automatically — a former admin's connected AI loses access the moment the demotion happens. See Manage workspaces, members, and roles for how role changes work.