StackTether Support
Menu
All support topics

AI access: app switches and safeguards

Short answer: AI access (admins only) holds every AI setting for your MSP. Switch on the AI apps your team may use; an app that is off cannot connect, and turning one off disconnects everyone using it. The same page lists connected apps with Disconnect, the emergency Disconnect all AI apps now, the unusual-activity checks, the optional country list for local apps and travel overrides.

A plain summary at the top of the page says what is on, how many connections there are and any active pauses or travel overrides.

Allowed AI apps

  • Every app is off for a new MSP. Click Turn on next to each app your team uses.
  • Cloud apps each have their own switch: Claude (cloud), ChatGPT, Microsoft 365 Copilot, Copilot Studio, Gemini Enterprise, Cursor (cloud agents), Perplexity, Grok (xAI).
  • Local apps: one switch for apps on a tech's computer, plus separate switches for VS Code (which also needs Local apps) and Google Antigravity.
  • Turn off asks you to confirm with Turn off and disconnect: everyone in your MSP who connected the app is disconnected now and cannot connect it again until it is turned back on.
  • Badges show network limits: Restricted to Anthropic's network (Claude, enforced) and Watching OpenAI's network (ChatGPT, counted only).

Per person

On a member's page (from Team), the AI access panel lets you turn any app your MSP allows off for that one person, or All off / All on. It is on for everyone by default. Turning it off ends that person's connections of the app at once, and the consent page tells them "Your admin has turned this app off for you."

Connected AI apps

Lists each connection with App, Member, Sends back to, State, Approved and Approval ends. Disconnect ends one. Your MSP's other admins are emailed when someone connects an app (at most one email per member per app per day).

Disconnect all AI apps (kill switch)

For emergencies such as a lost laptop or a suspected break-in: Disconnect all AI apps now, then confirm with Disconnect all AI apps. Every AI connection in your MSP ends at once, the primary admin's included. Techs can connect again afterwards; to keep an app out, turn it off. StackTether support also has a platform-wide stop for every MSP.

Unusual activity

  • StackTether counts the records each member's AI apps pull in any 60 minutes and compares that with the member's own busiest 60 minutes of the last 14 days.
  • Well above it: admins are emailed (records per tool, never content). Further above: the member's AI apps are slowed to one call a minute until the count drops. Far above: their AI access is paused until an admin reviews it.
  • New MSPs start in Watch mode: emails go out (marked "Watch mode: nothing was blocked"), slow-downs and pauses are only counted ("would have paused N times"). Click Enforce to turn them on, Back to watch mode to undo.
  • Paused members appear under Paused AI access with Resume, Keep paused and Disconnect. Only Resume ends a pause. A tech can never resume their own pause; an admin resuming their own must type a fresh 2FA code.

Countries for local apps

  • Optional. Add the countries your techs work from with Add a country (type part of a name; group shortcuts such as United States + Canada are offered), then Save list. Clear list removes it.
  • A new list starts in watch mode; nothing is refused until you click Enforce the list. Adding countries keeps an enforced list enforced; removing any puts it back in watch mode.
  • It applies to local apps only. Cloud apps call from their vendor's servers.

Travel overrides

  1. Under Travel overrides, choose the Member, add countries and enter Days (1 to 60).
  2. Click Add travel override. For an override for yourself, also type a fresh 2FA code.

It ends by itself at the end of the last day; Remove ends it early. The other admins are emailed when one is added, and the member sees it read-only on Account. At most 5 per member.

Other automatic protections

  • Access tokens older than 15 minutes are refused, so apps renew them in the background.
  • Approvals last 30 days for cloud apps and 7 days for local apps; a connection unused for 14 days is disconnected.
  • Admins are emailed when a tech's local app calls from a new network or country.
  • Every refusal tells the tech one plain sentence; you see the same reason in the audit log.

FAQ

Why does VS Code not connect although it is on?

VS Code needs both its own switch and Local apps.

Can I see which country a call came from?

The audit log shows the IP address. Country checks use the location of that address.