Approve the AI apps your organization uses
Deze inhoud is nog niet vertaald.
Your organization decides which AI apps may read its Focus data, app by app. The list under Settings → AI → Apps starts empty, and Focus does not suggest or pre-approve any app, however well known. Until the owner approves an app, nobody in the organization can connect it, even with Allow AI access and Allow external AI apps (MCP) on (AI settings).
Requests appear on their own
Section titled “Requests appear on their own”When someone tries to connect an app that is not approved, the sign-in page tells them that the organization has not
approved it yet and that their request has been recorded (client_not_allowed). The request appears in the list
with:
- the app’s name and the address it belongs to,
- the addresses it sends people back to after sign-in,
- how many times it was requested, when, and who asked last.
Check the addresses, not only the name: anyone can give an app any name, but only its maker controls its address. Admins see the list; only the owner can decide.
Approve, deny or revoke
Section titled “Approve, deny or revoke”- Approve lets everyone in the organization connect the app, each with their own consent
(connecting an AI app). You can add a note, for example the number of your contract
with the app’s provider. Approving widens what leaves Focus, so it asks you to confirm your sign-in and to confirm
the summary of what will be shared (
acknowledgement_required); a new version of the privacy notice about AI apps is then published for your employees (AI settings). - Deny closes the request. The app stays denied; when people keep trying, its request count and last request still grow, so you can see that it is still wanted and approve it later.
- Revoke takes back an approval. Every connection of that app in your organization ends at once, and the app’s next request fails. The approved row shows how many connections are active before you revoke. A revoked app can be approved again later.
Every decision is recorded with who made it, when and the note, and is written to the
audit log. Approving an app that is already approved is refused
(client_already_approved).
Add an app by its client ID
Section titled “Add an app by its client ID”To approve an app before anyone asks for it, choose Add by client ID and enter the app’s client ID. For most
MCP apps this is an https:// address of a small document in which the app describes itself; the app’s provider
publishes it. When you choose Approve, Focus reads the document and adds the app as approved in the same step;
there is no preview first. So enter only a client ID you got from the app’s provider. The app’s name and addresses
then appear in the list: check them, and revoke the app at once if they are not what you expected.
The app is refused when its document breaks the rules (client_metadata_invalid), for example when it is not served
over https://, names a different client ID or asks for a client secret, and when the document cannot be read
(client_metadata_unreachable), for example because it does not answer within 5 seconds, is larger than 64 KB or
is not on a public address. An AI app cannot connect explains both.
Your responsibility for what you share
Section titled “Your responsibility for what you share”When you approve an AI app, your organization chooses to send data to that app and to the AI provider behind it. For that data your organization is the data controller, and the app’s provider is your processor or a recipient you choose, not Workify360’s. Before approving, make sure you have what you need for it: an agreement with the app’s provider that covers this data and, when the provider is abroad, a lawful basis for the transfer under KVKK. The confirmation you give when approving says this in the same words.