See Roles and access for the role comparison.
Discovery does not grant permission to call
An agent may see a remote tool intools/list and still lack permission to call it. Every remote call requires update permission, including a tool that describes itself as read-only.
For example, a Reader can discover a team’s issue-tracker tools. To use them through the gateway, they need a workspace role with update permission. The issue tracker then applies the permissions of the credential used for the call.
Remote invocation is controlled at the server workspace level. There is no separate permission setting for each remote tool.
Shared and personal connections
Atlan sends your Atlan token only to its own service. It resolves the configured credential for an external server instead of forwarding your Atlan token there.
An administrator can disable a server without deleting it. Disabled servers stay registered but contribute no callable tools. Disabling an OAuth provider also prevents calls that use that provider.
Verify access
Refreshtools/list as the person who will use the tools. Inspect the response’s _meta when a server is missing: it distinguishes unavailable servers from those that need your connection. Then make an appropriate test call and confirm the result in Track usage and audit tool calls.