﻿AUTOM8LABS - AutoCAD Administrator Tool Permissions
Example registry files v1.0.0

Choose which tools MCP Connector for AutoCAD may run on a computer.
These examples are for AutoCAD connector 2.2.0 or later on Windows.

SCOPE

The settings in these files apply to every user of the computer. To give
chosen people different permissions, use the Group Policy template the
installer provides (see GROUP POLICY below). The settings do not request a
CAD Manager's approval for a particular action. They restrict this
connector's tool calls; they do not restrict manual AutoCAD commands or
other plug-ins.

Administrator rights are required to change the settings. Named tool lists
require an active Pro licence. ForceReadOnly applies in every edition.
These files do not enable logging or change any AuditLog settings.

CHOOSE AN EXAMPLE

force-read-only.reg
  Sets ForceReadOnly (DWORD) to 1. Locks the connector's Read-Only Session
  switch on. The free read-only tools remain available: query, list, measure
  and navigate. Every other tool is excluded.
  Existing licence and tool restrictions still apply.

block-selected-tools.reg
  Sets BlockedTools (REG_SZ) to:
  erase_entities; purge_drawing; delete_layout;
  delete_block_definition
  Blocks these exact tools.
  Other tools may perform similar changes. This is not a comprehensive list
  of every tool that can delete or remove something.

allow-approved-tools.reg
  Sets AllowedTools (REG_SZ) to:
  get_drawing_info; list_layers; get_entities
  Only these drawing tools are allowed. Essential connection/session tools
  remain available, subject to the connector's other policy checks.
  New drawing tools stay unavailable until added to the list.
  Do not leave AllowedTools empty: an empty value removes this restriction.

Each file sets ONE value. Importing it replaces that value; it does not add
entries to an existing list. Before importing BlockedTools, include any names
already blocked that must stay blocked. Review the entire AllowedTools list
before replacing it. All other values are left in place.

BlockedTools wins over AllowedTools. ForceReadOnly still applies; an allow
list cannot grant tools excluded by that setting or a licence.
Named tool lists are ignored without Pro. To enforce read-only in every
edition, use ForceReadOnly.

SET UP

1. Extract this ZIP and open the chosen .reg file in Notepad to review it.
   Use exact tool names from the AutoCAD documentation. Separate names
   with semicolons. The supplied files use UTF-16 LE with a BOM and Windows
   lines.

2. Open Registry Editor as administrator. Locate this key:
   HKEY_LOCAL_MACHINE\SOFTWARE\AUTOM8LABS\MCPConnectorAutoCAD
   If it exists, select it and use File > Export with Selected branch to save
   a backup. Note whether the value your example will set already exists.
   If the key or value is absent, note that instead.

3. In Registry Editor, use File > Import to import your reviewed example.
   Import only the example(s) you need; existing restrictions combine.

4. Restart AutoCAD, then fully quit and reopen the AI app so its tool list
   is refreshed. Start a new chat. Ask the connector to run get_session_info
   and report its administrator policy and read-only state, then check the
   advertised tool list. Do not test a block by attempting a destructive call.
   If existing policy blocks get_session_info, check the connector dialog,
   registry values and refreshed tool list instead.

5. For team deployment, apply the reviewed settings to each relevant computer
   through your IT deployment process. A CAD Manager using a restricted
   computer receives that computer's restrictions too.

GROUP POLICY

The installer puts a Group Policy template in this folder:
C:\Program Files\Autodesk\ApplicationPlugins\AUTOM8LABS.MCPConnectorAutoCAD.bundle\Contents\Resources\Policy
The files are AUTOM8LABS.MCPConnectorAutoCAD.admx and
en-US\AUTOM8LABS.MCPConnectorAutoCAD.adml. Copy the .admx to your
PolicyDefinitions folder and the .adml to its en-US folder. The settings then
appear in the Group Policy editor under Administrative Templates, for
computers and for users.

A user policy applies to the people it targets and can only tighten what the
computer allows: a tool blocked in any policy is blocked. To keep a tool for
CAD Managers, block it in a user policy that applies to everyone else.

RESTORE PREVIOUS SETTINGS

Close AutoCAD. In Registry Editor as administrator:

- If the example's value existed before, restore its exact previous type
  and data from your backup.
- If it did not exist before, delete only that value (ForceReadOnly,
  BlockedTools or AllowedTools, depending on the example used).

Keep the connector key and its other values, including audit settings.
Importing an old backup alone does not remove values added after that backup.
Do not clear AllowedTools as a way to block every tool: blank means no allow
list restriction. Restart AutoCAD and the AI app after restoring the
settings.

AUDITING

Logging is separate. To record tool activity, follow Tool Use Audit dashboard:
https://autom8labs.io/products/mcp-connector-autocad/docs/#tool-use-audit

Permissions guide and tool reference:
https://autom8labs.io/products/mcp-connector-autocad/docs/#administrator-permissions
