Feedback and Ideas

OAuth access token scoping at the data source level

block issuance of tokens that have access to specific data sources

. This capability is required for us to safely adopt 

 for our environment, where certain data sources are classified as more sensitive and must not be exposed to broad-scoped tokens.

 as the recommended authentication path for MCP host applications, using the 

 as described in the Glean documentation.

act as an OAuth 2.1 Authorization Server and Resource Server

, delegating user authentication to our existing SSO IdP (OIDC/SAML).

relevant scopes are automatically managed during the OAuth flow

, without an admin-level way to constrain them per data source.

different sensitivity tiers across data sources

 (e.g., some contain highly confidential or regulated information). Our security and compliance requirements mandate that:

Tokens presented to MCP hosts must not have blanket access across all configured data sources.

confidently ensure that certain high‑sensitivity data sources are never accessible

 via particular MCP integrations, even if the user is otherwise entitled to see them within Glean.

 aligned with the intended use case of a specific MCP host.

Because the current OAuth implementation does not provide 

data‑source‑level scoping or explicit blocking

, any token that allows MCP access effectively inherits the full set of data sources available to the user through Glean search/agents. This is a 

 to production for some of our critical teams.

Integrating certain high‑risk applications and workflows with Glean until we can guarantee that 

tokens cannot be used to access high‑sensitivity data sources

 for MCP and future Client API integrations. Specifically, we propose one or more of the following capabilities:

Administrative controls to block token issuance for specific data sources

Implementing data source–level token scoping or explicit blocking would:

Allow us to safely integrate MCP hosts with Glean while 

respecting our internal data classification and segregation policies

Align with the documented goal of offering 

fine‑grained scopes for future Client API integrations

, extending that fine‑grained model from “capability‑based” to include 

We would be happy to collaborate on design feedback or early access if this capability is considered for an upcoming release.

Glean OAuth Authorization Server - Glean Help Center

Feature Request - MCP OAuth Token Scoping by Data Source

Home

Forum

Events

Content

Courses

Collections

People

Contributors

Albums

Groups

Chat

Channels

Tools

Help

Welcome to the Gleaniverse. Empowering work with AI. Connected by knowledge. Growing together. Search Where would you like to start? Join the discussions.

Glean Community

Gleaniverse Community

Copyright

Terms of Service

Privacy Policy

Code of Conduct

Your Privacy Choices

It looks like there is no account associated with the email you provided. The event is for members only. Please complete the application to join our community first.

Thank you for your interest in joining us

Thanks for your interest in joining the event. However, your account is still pending. Once it's approved, you'll be able to register for the event. Please contact us via community@glean.com if you need support.

Pending Approval

Login to the Glean Community to connect with others, attend community events, and more!

Login or Sign Up for even more

To unlock all parts of the community and get the best experience, complete your profile.

Hey, complete your profile

It looks like there is no account associated with the email you provided. Please complete the application to join our community.

Thank you for your interest in joining Glean Community.

Thanks for your interest in joining Glean Community. We will review your request shortly and email you once it's approved. Meanwhile, please feel free to contact us via community@glean.com for any questions.