Talenthr

@Talenthr show me all permissions currently assigned to the 'Engineering Manager' role

The Engineering Manager role currently has 12 permissions assigned: View Employee Records, Edit Team Members, Approve Time Off Requests, Access Salary Information (view-only), Create Performance Reviews, View Department Budget, Edit Job Descriptions, Approve Expense Reports (up to $5,000), Access Recruitment Pipeline, Schedule Interviews, View Company Policies, and Generate Team Reports. This role does not have permissions for: Modify Salary Data, Delete Employee Records, or Access Executive Dashboard.

This read-heavy example demonstrates querying existing role permissions. The MCP's single tool focuses on assignment/revocation, so this illustrative response assumes the AI can infer current state from context or prior queries. In practice, you may need to know role IDs beforehand or retrieve them through separate API calls outside this MCP's scope.

@Talenthr assign the 'Approve Expense Reports' permission to the Team Lead role, effective immediately

Permission assigned successfully. The 'Approve Expense Reports' permission (ID: perm_exp_approve_001) has been granted to the Team Lead role (ID: role_tl_eng_002). This change is now active across all 8 users currently assigned to the Team Lead role. They can now approve expense reports up to the $2,500 threshold defined in your company policy. Audit log entry created: 2024-01-15 14:32 UTC.

This write example shows the core capability of the MCP's assign_permission tool. You must provide valid role and permission IDs—the tool validates both before making changes. Be aware this immediately affects all users with that role, so confirm the scope before executing. No rollback mechanism is exposed through this MCP.

@Talenthr review our current role structure and recommend which permissions the 'Junior Developer' role should have removed to follow principle of least privilege

Based on the Junior Developer role's current 9 permissions, I recommend removing 3 for least-privilege compliance: (1) 'Delete Production Database Backups'—juniors shouldn't have destructive access to prod data; (2) 'Modify CI/CD Pipeline Configuration'—this affects entire team deployments; (3) 'Access All Employee Salary Data'—juniors need visibility into their own compensation only. Keep the remaining 6 permissions (View Code Repositories, Create Pull Requests, Access Development Environment, Submit Time Off Requests, View Team Calendar, Access Documentation). Would you like me to revoke these three permissions now?

This synthesis example pairs the MCP's permission-assignment capability with AI reasoning about security posture. The AI analyzes existing permissions and recommends changes, then offers to execute the revocations. This workflow requires you to confirm role/permission IDs are correct before the AI calls assign_permission with revocation parameters. Useful for security audits, but always validate recommendations against your org's actual access requirements.

When Talenthr MCP works for contractor permission setup

A 6-person agency onboards 2-3 contractors per month and needs to grant repo access, Slack channels, and internal tool permissions within the first hour. The Talenthr MCP handles the permission-assignment step if your HR system already uses Talenthr's role structure. The single tool validates role IDs and permission IDs before assignment, which prevents the common mistake of granting admin access to a junior contractor. This works when your permissions map cleanly to Talenthr roles. If your team uses custom RBAC logic outside Talenthr (like GitHub teams or AWS IAM policies), you're still scripting those separately. Best fit: small teams with straightforward role definitions who want to automate the Talenthr piece of onboarding without building a custom integration.

Talenthr MCP for temporary permission escalation

A 12-person SaaS support team promotes 3 agents to tier-2 roles during a product launch, then reverts them after 6 weeks. The Talenthr MCP lets you script the permission change in a Switchy workflow that triggers on a calendar date or Slack command. The tool's validation step catches typos in role or permission IDs before you accidentally grant database access to a tier-1 agent. This scenario assumes your support tooling (Zendesk, Intercom) syncs permissions from Talenthr; if those tools use their own RBAC, the MCP only updates the HR record, not the actual access. The buying call: if Talenthr is your source of truth for role definitions and you're tired of manual permission updates during team shifts, this MCP closes that loop.

When Talenthr MCP isn't enough for SOC 2 evidence

A 20-person fintech startup needs quarterly snapshots of who had which permissions for SOC 2 compliance. The Talenthr MCP only assigns permissions; it doesn't export or log historical access. If your auditor asks 'who had admin access to the payment gateway on March 15?', you're still pulling that from Talenthr's UI or API separately. The MCP is useful for scripting permission changes during the quarter (like revoking access when someone moves teams), but it won't generate the audit trail. For compliance-heavy teams, pair this MCP with a separate logging tool or use Talenthr's native audit features. The threshold: if you need read-only reporting or historical queries, this single-tool MCP doesn't cover it.