MCP server and AI apps
Revoking and resetting AI access
How Disconnect works, how admins retry revocation and reset a connection, and what revoking a user does.
Revoking and resetting AI access
AI access can be stopped by the person themselves or by an admin. Reconnecting after a disconnect is deliberately a reviewed step.
The person disconnects
In HockeyStick Settings, the Connected AI apps card shows "Provider identity: Linked" and a Disconnect button. Clicking it:
- Blocks the account straight away. Existing access tokens and refresh grants can no longer reattach, even if the AI app still holds them.
- Queues revocation of the person's Auth0 grants for the MCP.
- Writes a
disconnectaudit row.
The card then reads "Disconnected. Remove this connection in your AI app. Contact support before reconnecting." with a Grant revocation status: In progress, Confirmed, or Needs support.
Remind the person to remove the connector in each app too. Signing out of HockeyStick in a browser does not disconnect anything.
What you see in the Command Centre
On the Users page, the Login migration column shows AI disconnected with the grant revocation status. Two admin-only buttons appear:
| Button | When to use it |
|---|---|
| Retry grants | Revocation is pending or failed. It retries without lifting the block. A failure leaves AI access blocked. |
| Reset AI | The person needs to reconnect. Enabled only once revocation is confirmed, about an hour has passed so old tokens have expired, and provider configuration is verified. |
Reset asks "Reset AI connection for" the person, then clears the block. The person can then sign in again with an email code, and the first call links them afresh. An admin_reset audit row is written.
Consultants can see the status but cannot retry or reset. Ask an admin.
Revoking a user entirely
Revoke on the Users page removes the person's HockeyStick access, including AI access, because the MCP only admits active users. Their linked identity stays reserved: re-inviting the same email does not transfer it, and the page notes that recovery needs admin review.
What revocation does not do
- It does not pull back data the AI app already received. That stays in the app's conversation history.
- There is no global off switch for all AI connections. Turning MCP off for a whole environment is an engineering configuration change.