AI agents

How AI agents narrow MCP roles and skills per tenant — instructions, the effective-permissions rule, how to pick one when connecting and how Plur-e can disable one.

Quick answer

An AI agent is a named profile a tenant administrator creates in AI & MCP → AI agents: custom instructions (up to 4000 characters), a set of MCP roles it references and, for Business Central, the sections it can see. An AI agent never widens what a user can already do — it only narrows it. A tenant user picks one on the consent screen when connecting, with select_agent, or with the X-Plure-Agent header; without one, every call still works exactly as MCP roles alone describe.

What an AI agent is

An AI agent belongs to one tenant and lists: custom instructions for the AI assistant (up to 4000 characters), the MCP roles it references, the skills it allows per area, and the tools it allows.
Instructions are a starting point for the conversation — extra context, tone or procedure the tenant administrator wants the AI assistant to follow — not a way to grant access a role does not already allow.
Only a tenant administrator creates and edits AI agents, in the Admin Center. Nothing in an MCP client can create or modify one.

Three layers, one rule

Layer	Controls
MCP roles	Which entities (Dynamics 365 CRM) or areas (Business Central) a user can read, write, post or delete
Web role	Which skills are visible to that user in the Admin Center
AI agent	Custom instructions, plus which of the user's roles, skills and tools apply for this connection

The rule is always the same: effective access is the user's access intersected with the AI agent's. If the AI agent does not mention a role, a skill or a tool the user has, that role, skill or tool is simply not offered while the AI agent is selected — it is never added on top of what the user already has. An AI agent with an empty list for something (no roles listed, no skills restricted) means it inherits the user's full access for that layer instead of narrowing it.

Create one

In the Admin Center, go to AI & MCP → AI agents and press New AI agent: give it a name, write its instructions, and pick the MCP roles, Business Central sections and tools it should narrow the connection to. Only a tenant administrator can do this — see MCP roles for how roles themselves are created and assigned.

Pick it when connecting

Consent screen: tenant users seeing the OAuth consent screen while connecting get an AI agent dropdown listing the tenant's AI agents, plus "None". Picking one fixes it for that connection.
select_agent: any client can call select_agent with the agent's exact name, or with "none" to clear the one already selected, at any point in the conversation.
X-Plure-Agent header: stateless clients that send a header on every request can send X-Plure-Agent with the agent's name on every call; sending X-Plure-Agent: none clears it.

Two read-only tools help a client discover what is available: plure_list_agents (the tenant's AI agents, name and description) and plure_current_agent (the one selected for this connection, if any).

What changes

Instructions picked on the consent screen or through the X-Plure-Agent header are injected into initialize, so the AI assistant sees them from the very first message.
Instructions picked mid-conversation with select_agent come back in that tool's result instead — a client can only see them once it calls the tool — and are also available afterwards from the MCP resource plure-bc://agent (Business Central) or plure-crm://agent (Dynamics 365 CRM).

Business Central granularity is the section

An AI agent narrows Business Central access at the section level — the same 16 sections (bc_wms_receipts, bc_sales, …) that MCP roles areas map to — not at the level of an individual method inside a section.

Disable by Plur-e

Plur-e can disable an AI agent for every user of a tenant from the /super server or the Admin Center's platform area, regardless of what the tenant configured. A disabled AI agent cannot be selected on the consent screen, with select_agent or with the X-Plure-Agent header until Plur-e re-enables it.