AUTOM8LABS - Revit Administrator Tool Permissions
Example registry files v1.0.0

Choose which tools MCP Connector for Revit may run on a computer.
These examples are for Revit connector 3.8.0 or later on Windows.

SCOPE

The settings apply to every user of the computer. They do not assign roles
to individual people or Windows groups, and do not request a BIM Manager's
approval for a particular action. They restrict this connector's tool calls;
they do not restrict manual Revit commands or other add-ins.

Administrator rights are required to change the settings. Named tool lists
require an active Pro licence. ForceReadOnly applies in every edition.
These files do not enable logging or change any AuditLog settings.

CHOOSE AN EXAMPLE

force-read-only.reg
  Sets ForceReadOnly (DWORD) to 1. Locks the connector's Read-Only Session
  switch on. Queries, checks and exports remain available; tools that change
  the model are excluded. Existing licence and tool restrictions still apply.

block-selected-tools.reg
  Sets BlockedTools (REG_SZ) to:
  delete_elements; purge_unused; deep_purge; ungroup_elements
  Blocks these exact tools, including their preview/dry-run options.
  Other tools may perform similar changes. This is not a comprehensive list
  of every tool that can delete, purge or ungroup something.

allow-approved-tools.reg
  Sets AllowedTools (REG_SZ) to:
  get_document_info; get_levels; get_elements
  Only these model tools are allowed. Essential connection/session tools
  remain available, subject to the connector's other policy checks.
  New model tools stay unavailable until added to the list.
  Do not leave AllowedTools empty: an empty value removes this restriction.

Each file sets ONE value. Importing it replaces that value; it does not add
entries to an existing list. Before importing BlockedTools, include any names
already blocked that must stay blocked. Review the entire AllowedTools list
before replacing it. All other values are left in place.

BlockedTools wins over AllowedTools. ForceReadOnly and disabled packs still
apply; an allow list cannot grant tools excluded by those settings or a licence.
Named tool lists are ignored without Pro. To enforce read-only in every
edition, use ForceReadOnly.

SET UP

1. Extract this ZIP and open the chosen .reg file in Notepad to review it.
   Use exact tool names from the Revit documentation. Separate names with
   semicolons. The supplied files use UTF-16 LE with a BOM and Windows lines.

2. Open Registry Editor as administrator. Locate this key:
   HKEY_LOCAL_MACHINE\SOFTWARE\AUTOM8LABS\MCPConnectorRevit
   If it exists, select it and use File > Export with Selected branch to save
   a backup. Note whether the value your example will set already exists.
   If the key or value is absent, note that instead.

3. In Registry Editor, use File > Import to import your reviewed example.
   Import only the example(s) you need; existing restrictions combine.

4. Restart Revit, then fully quit and reopen the AI app so its tool list is
   refreshed. Start a new chat. Ask the connector to run get_session_info
   and report its administrator policy and read-only state, then check the
   advertised tool list. Do not test a block by attempting a destructive call.
   If existing policy blocks get_session_info, check the connector dialog,
   registry values and refreshed tool list instead.

5. For team deployment, apply the reviewed settings to each relevant computer
   through your IT deployment process. A BIM Manager using a restricted
   computer receives that computer's restrictions too.

RESTORE PREVIOUS SETTINGS

Close Revit. In Registry Editor as administrator:

- If the example's value existed before, restore its exact previous type
  and data from your backup.
- If it did not exist before, delete only that value (ForceReadOnly,
  BlockedTools or AllowedTools, depending on the example used).

Keep the connector key and its other values, including audit settings.
Importing an old backup alone does not remove values added after that backup.
Do not clear AllowedTools as a way to block every tool: blank means no allow
list restriction. Restart Revit and the AI app after restoring the settings.

AUDITING

Logging is separate. To record tool activity, follow Tool Use Audit dashboard:
https://autom8labs.io/products/mcp-connector-revit/docs/#tool-use-audit

Permissions guide and tool reference:
https://autom8labs.io/products/mcp-connector-revit/docs/#administrator-permissions

