# Landlord MCP permissions and safety

Landlord MCP is the source of rental financial and operational truth. Email, documents, receipts, and model output are evidence or proposals, not posted ledger facts.

## Three separate boundaries

1. **Account:** the person signs in with Google or an available email option on a secure account page. New email signup is disabled pending auth-sender isolation; check [current options](https://app.landlordmcp.com/api/signup/options). Existing email/password sign-in remains available. A submitted email is not verified identity.
2. **Connection:** a real client-originated authorization request identifies the AI client and callback. The person reviews it, chooses an eligible organization, and explicitly approves. Signing up does not connect an AI. The normal protected endpoint is **https://mcp.landlordmcp.com/mcp**; the signup-only endpoint cannot read private records.
3. **Payment:** an organization owner separately reviews plan pricing and initiates browser checkout. A link does not buy a subscription. Neither a query parameter nor an AI statement proves payment; verified billing events determine paid access.

## Working with rental records

- Read `rentledger://operating-rules` and `rentledger://organization` before acting. The selected organization and current permissions constrain every request; do not supply a different organization to bypass access checks.
- Read the actual tool schemas. A model name or a directory logo does not grant extra authority. An owner's AI connection does not inherit their full browser approval role.
- Keep consequential payments, charges, credits, lease changes, notices, reconciliation closure, deposits, and move-out settlements as drafts or proposals until separately reviewed. AI callers must not approve their own work.
- Correct posted financial history through compensating entries, never silent editing or deletion. Retain the reason, source evidence, and audit history.
- The AI client obtains email, attachments, browser observations, and payment receipts with the person's approved external tools. Landlord MCP does not poll mailboxes, store mailbox credentials, or send renter email. Only log an outbound message as sent after an external sending tool returns a durable delivery reference.
- Avoid collecting or exposing unnecessary renter data. Never put account passwords, verification links/tokens, provider keys, or payment-card details into a conversation, public guide, screenshot, or source-controlled config.
- Do not bypass browser warnings, install confirmations, sign-in restrictions, or user approval prompts. If a handoff fails, report what happened and offer manual setup.
- Copied setup, an opened application, and successful account sign-in are not evidence of a working connection. Verify an authenticated organization read and a bounded read-only tool. Report failures and untested clients honestly.

Page-level WebMCP discovery, where supported, does not create a persistent remote-MCP authorization. Browser actions keep the same account, organization, human-review, and payment boundaries. An exposed page-tool name is not a successful execution receipt.

See [getting started](https://landlordmcp.com/ai/getting-started.md), [client setup and status](https://landlordmcp.com/ai/clients.md), and the [human connection guide](https://landlordmcp.com/connect).