Skip to main content
Passport sits between an AI client and the work app it wants to use. It keeps the app credential, checks access and Safety, makes the call, and records the outcome.

​
The five things to know

​
Workspace

A workspace is your team’s private space in Passport. It holds people, apps, settings, and Activity. Workspaces are isolated from one another, and you can switch if you belong to more than one.

​
Apps

An app is something your AI client can use through Passport, such as GitHub, Linear, Stripe, or Notion. Open Apps to browse, connect, and manage them. Some apps connect through MCP. Others use a reviewed API integration. Passport gives both the same connection, access, Safety, and Activity experience, so most people do not need to care which technology is underneath.

​
Clients

A client is where you use AI: Claude, Cursor, ChatGPT, VS Code, Codex, Passport CLI, or another MCP-compatible product. Open Clients to add one, see its connection status, disconnect it, or choose which available apps it can see.

​
Access

Access answers one question: what may this person do with this app?

Full

Read and write tools are available.

Read-only

Write tools are hidden from the client.

None

The app is not shown to that person.
Enterprise admins can set access for the workspace, a team, or a person. A more specific choice wins. A person’s client-level app selection can narrow access further, but can never grant more.

​
Activity

Every call through Passport creates an Activity record with the person, client, app, action, outcome, and timing. Members see their own records. Enterprise admins can review the workspace-wide log in Audit.

​
What happens during a call

1

Identify the person and client

Passport checks the signed-in identity and the connection being used.
2

Apply access and Safety

Apps or actions that are not allowed are hidden, blocked, or held for approval.
3

Inspect the request

Guardrails check outgoing arguments before Passport contacts the app.
4

Call the app

Passport uses the connected account on the person’s behalf.
5

Inspect and record the result

Guardrails check the result, then Passport writes Activity and returns the safe response.

​
People, teams, and automation

  • Admins manage the workspace and its rules.
  • Members connect clients and use the apps available to them.
  • Agents are identities for scripts and CI. They use an agent key and cannot answer interactive approval prompts.
  • Teams let Enterprise admins apply access and client defaults to a group instead of one person at a time.
Deactivating a person revokes their sessions, clients, and connected accounts immediately.

​
Advanced building blocks

  • A bundle combines a curated set of tools from several apps behind one connection.
  • Tool discovery modes control how a large tool catalog is presented to an AI client.
  • Managed API integrations connect reviewed provider APIs through the same Passport gateway.
Most people should copy the connector address shown under Clients → Add client. For CLI agent keys, set PASSPORT_ENDPOINT to the workspace URL (/w/ws_…/mcp). See Passport CLI.