Tool Access
Understand how tools are assigned to agents, users, and groups via direct assignment and toolsets.
Tool Access
Datatape controls which tools are available to each consumer — whether that consumer is an agent, a user, or a group. Access is managed through direct assignment and toolsets.
Direct assignment
The simplest way to give an agent or user access to a tool is to assign it directly.
- Agents — assign tools on the agent detail page
- Users — assign tools from the user's access settings
Direct assignment is best when you need fine-grained control over exactly which tools a specific agent or user can call.
Toolsets
A toolset is a named group of tools. Instead of assigning tools one by one, create a toolset and assign the entire group.
Toolsets can be assigned to:
- Agents — the agent can call all tools in the toolset
- Users — the user can call all tools in the toolset via OAuth
- Groups — all members of the group can call all tools in the toolset

Example
Create a toolset called "Customer Data" containing lookup_customer, customer_orders, and customer_revenue. Then assign it to:
- The "Support Bot" agent — so the bot can answer customer questions
- The Support group — so all support team members can use these tools via Claude Desktop
If you later add a new tool to the toolset, it automatically becomes available to all assigned agents, users, and groups.
How access is resolved
When a request arrives, Datatape determines the visible tools based on who is calling:
| Caller | Tools visible |
|---|---|
| Agent (API key) | Tools assigned directly + tools from assigned toolsets |
| User (OAuth/JWT) | Tools assigned directly + tools from assigned toolsets + tools from group toolsets |
Tools from different sources can be mixed in the same toolset. For example, a toolset could include PostgreSQL queries alongside Snowflake queries.
Managing access
For agents
- Go to Agents and select the agent
- In the Tools section, assign individual tools or toolsets
- Changes take effect immediately — the next request from the agent will reflect the updated tool list
For users
- Go to Team > Members and select a user
- Assign tools or toolsets to the user
- The user's OAuth sessions will see the updated tools on their next
tools/listcall
For groups
- Go to Team > Groups and select or create a group
- Assign toolsets to the group
- All members of the group inherit access to the toolset's tools
Best practices
- Use toolsets for shared access patterns. If multiple agents or users need the same tools, create a toolset instead of duplicating direct assignments.
- Use groups for team-wide access. Assign toolsets to groups so new team members automatically get the right tools.
- Use direct assignment for exceptions. If one agent needs a tool that nobody else does, assign it directly rather than creating a single-use toolset.
- Audit regularly. Review agent and toolset assignments to ensure the principle of least privilege.