How do I revoke MCP access to the NIS2 walkthrough?
In Settings, under “Connected”. “Disconnect” ends one assistant. “Disconnect all assistants” ends your key and every sign-in at once, in every company you are a member of; any change to your password does the same. Signing out of the browser ends no assistant.
Where do you disconnect a single assistant?
You open Settings from the profile menu at the bottom of the left sidebar. In the card “Connect assistants like Claude or Copilot” is the section “Connected”, with every assistant you connected in the company that is open.
A pasted key appears there as “Pasted key”; a browser sign-in carries the name the assistant gave itself. Each shows when it was connected and when it was last used.
Next to each entry is “Disconnect”. The assistant is disconnected from its next call, and a browser sign-in can no longer be renewed after that. The others stay connected, and so do your assistants in other companies.
How do you disconnect all assistants at once?
“Disconnect all assistants” ends your key and every browser sign-in at once. The same happens with any change to your password: when you reset it, set one for the first time or remove it to sign in with Google.
These routes are tied to your account, so they end your assistants in every company you are a member of. This cannot be undone; every assistant then needs a new sign-in or a new key.
Signing out of the browser ends no assistant, because key and sign-in outlast the session. That is why connecting needs a sign-in from the last 15 minutes, and you get an email as soon as an assistant was connected in your name.
If such an email arrives when you connected nothing yourself, choose “Disconnect all assistants” and reset your password.
What else ends a connection?
“Create a new key” ends the previous key in this company; assistants that signed in through the browser stay connected. So you hold at most one valid key per company.
A key ends on its own after 90 days, a sign-in 90 days after you allowed it. After that you connect the assistant again.
When an admin removes a person from the company, their key and every sign-in of theirs end for good. Inviting them back later brings none of them back. When an admin turns assistants off for the whole company, every connection of every member ends; more on that in our article on allowing assistants.
Both work through the person's account. If they are also a member of another company, their assistants end there as well.
Why does disconnecting belong in your access policy?
A connected assistant is an access to your data, with a person's rights. Art. 21(2)(i) NIS 2 asks for policies on human resources security and access control. The law names no separate duty for AI assistants; our reading is to treat an assistant's connection like any other access.
The template in 10.1 already says that access is blocked without delay when someone leaves and that rights go only as far as the task needs. Under “Which of these does your company have or do?” you can pick “Reviewing rights”, the yearly check of who may access what.
In “Connected” each person sees only their own assistants. So that check includes each person going through their list, with the day of last use, and disconnecting what they no longer need.
Art. 21(2)(i) NIS 2 · § 30(2) No. 9 BSIG
How the walkthrough does it
The disconnecting itself happens in Settings. When someone disconnects, you set in 10.1.
10.1 Write the staff, access and asset policy: “Your policy for staff, access and IT” already says that access is blocked when someone leaves. Write under “Anything else that applies at your company” that the same goes for connected assistants.
Pick “Reviewing rights” there. In that review each person goes through their “Connected” list in Settings, because it shows only what they connected themselves.
When someone leaves the company, an admin removes the person in the app. Their key and sign-ins end with it.
For everyone at once, an admin turns off “Allow AI assistants for this company” in Settings.
Common questions
Does an assistant end when I sign out?
No. Signing out ends your browser sessions, but no key and no sign-in of an assistant. For that, use “Disconnect” or “Disconnect all assistants” in Settings.
What happens to the entries of a disconnected assistant?
They stay, with its name and the day on the screen and in the activity log. Disconnecting ends the access from now on. Whatever is wrong you correct in the app.
Can an admin disconnect another person's assistant?
Not one by one. An admin can remove the person from the company or turn assistants off for the whole company, and both end their connections. Each person disconnects their own one by one.
My MCP key was in a shared file. What now?
Disconnect the entry “Pasted key” or create a new key, and the old one stops working. Take it out of the file and put the new one in an environment variable.
How fast does disconnecting take effect?
At the assistant's next call. Every call checks whether its connection still stands, and a sign-in can no longer be renewed after that.
Read next
- Enabling the MCP server and allowing AI assistantsAn admin turns assistants on in Settings; until then they are off. Where the switch is, who may flip it and which accounts can connect after that.
- Connecting MCP with OAuth or an API key?Browser sign-in or key: when to use which, how long tokens and keys last, and what ends a connection.
- Is an MCP server safe?That depends on the server. What the walkthrough's MCP server checks on every call, what an assistant cannot do there and what stays with you.
Sources
- Directive (EU) 2022/2555 (NIS 2), Art. 21(2)(i), publications.europa.eu
- open-isms, lib/mcp/connections.ts and lib/mcp/key-version.ts, github.com/NISD2/open-isms
- open-isms, server/trpc/routers/user.ts, lib/auth/credential-change.ts and lib/organization/membership.ts, github.com/NISD2/open-isms
- open-isms, server/trpc/routers/assistants.ts (setAllowed), github.com/NISD2/open-isms
- nisd2.eu documentation, docs/self-hosting/mcp, section Disconnecting
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Access Control & HR Security
Write the staff, access and asset policy
Who gets into what, and what happens when someone leaves.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days, before the first export or sign-off: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
