﻿AUTOM8LABS - Navisworks Administrator Tool Permissions
Example registry files v1.0.0

Choose which tools MCP Connector for Navisworks may run on a computer.
These examples are for Navisworks connector 1.1.0 or later on Windows.

SCOPE

The settings in these files apply to every user of the computer. To give
chosen people different permissions, use the Group Policy template the
installer provides (see GROUP POLICY below). The settings do not request a
BIM Manager's approval for a particular action. They restrict this
connector's tool calls; they do not restrict manual Navisworks commands or
other plug-ins.

Administrator rights are required to change the settings. Named tool lists
require an active Pro licence. ForceReadOnly applies in every edition.
These files do not enable logging or change any AuditLog settings.

CHOOSE AN EXAMPLE

force-read-only.reg
  Sets ForceReadOnly (DWORD) to 1. Locks the connector's Read-Only Session
  switch on. The free review tools remain available: query, inspect, measure
  and navigate. Tools that change the model or write files are excluded.
  Existing licence and tool restrictions still apply.

block-selected-tools.reg
  Sets BlockedTools (REG_SZ) to:
  delete_selection_set; delete_saved_viewpoint; delete_clash_test;
  delete_timeliner_task
  Blocks these exact tools.
  Other tools may perform similar changes. This is not a comprehensive list
  of every tool that can delete or remove something.

allow-approved-tools.reg
  Sets AllowedTools (REG_SZ) to:
  get_model_info; list_models; find_items
  Only these model tools are allowed. Essential connection/session tools
  remain available, subject to the connector's other policy checks.
  New model tools stay unavailable until added to the list.
  Do not leave AllowedTools empty: an empty value removes this restriction.

Each file sets ONE value. Importing it replaces that value; it does not add
entries to an existing list. Before importing BlockedTools, include any names
already blocked that must stay blocked. Review the entire AllowedTools list
before replacing it. All other values are left in place.

BlockedTools wins over AllowedTools. ForceReadOnly still applies; an allow
list cannot grant tools excluded by that setting or a licence.
Named tool lists are ignored without Pro. To enforce read-only in every
edition, use ForceReadOnly.

SET UP

1. Extract this ZIP and open the chosen .reg file in Notepad to review it.
   Use exact tool names from the Navisworks documentation. Separate names
   with semicolons. The supplied files use UTF-16 LE with a BOM and Windows
   lines.

2. Open Registry Editor as administrator. Locate this key:
   HKEY_LOCAL_MACHINE\SOFTWARE\AUTOM8LABS\MCPConnectorNavisworks
   If it exists, select it and use File > Export with Selected branch to save
   a backup. Note whether the value your example will set already exists.
   If the key or value is absent, note that instead.

3. In Registry Editor, use File > Import to import your reviewed example.
   Import only the example(s) you need; existing restrictions combine.

4. Restart Navisworks, then fully quit and reopen the AI app so its tool list
   is refreshed. Start a new chat. Ask the connector to run get_session_info
   and report its administrator policy and read-only state, then check the
   advertised tool list. Do not test a block by attempting a destructive call.
   If existing policy blocks get_session_info, check the connector dialog,
   registry values and refreshed tool list instead.

5. For team deployment, apply the reviewed settings to each relevant computer
   through your IT deployment process. A BIM Manager using a restricted
   computer receives that computer's restrictions too.

GROUP POLICY

The installer puts a Group Policy template in
C:\ProgramData\AUTOM8LABS\MCPConnectorNavisworks\Contents\Resources\Policy:
AUTOM8LABS.MCPConnectorNavisworks.admx and
en-US\AUTOM8LABS.MCPConnectorNavisworks.adml. Copy the .admx to your
PolicyDefinitions folder and the .adml to its en-US folder. The settings then
appear in the Group Policy editor under Administrative Templates, for
computers and for users.

A user policy applies to the people it targets and can only tighten what the
computer allows: a tool blocked in any policy is blocked. To keep a tool for
BIM Managers, block it in a user policy that applies to everyone else.

RESTORE PREVIOUS SETTINGS

Close Navisworks. In Registry Editor as administrator:

- If the example's value existed before, restore its exact previous type
  and data from your backup.
- If it did not exist before, delete only that value (ForceReadOnly,
  BlockedTools or AllowedTools, depending on the example used).

Keep the connector key and its other values, including audit settings.
Importing an old backup alone does not remove values added after that backup.
Do not clear AllowedTools as a way to block every tool: blank means no allow
list restriction. Restart Navisworks and the AI app after restoring the
settings.

AUDITING

Logging is separate. To record tool activity, follow Tool Use Audit dashboard:
https://autom8labs.io/products/mcp-connector-navisworks/docs/#tool-use-audit

Permissions guide and tool reference:
https://autom8labs.io/products/mcp-connector-navisworks/docs/#administrator-permissions
