IT

How Harriet connects to your HR and productivity systems safely—including MCP connectors managed alongside other integrations.

Control who can manage knowledge, workflows, integrations, and sensitive data.

Step-by-step guide to Okta SSO (OIDC) and SCIM user provisioning in Harriet, including group push for roles.

How optional skills extend Harriet, how MCP connectors are governed, and how Endpoint AI review fits in for some organizations.

Use user groups on knowledge documents so only the right people see them in search.

Choose the right metadata on knowledge documents for access control versus filtering and discovery.

Combine group membership with geography and structure so local answers rank first but wider context stays available.

Split versions by audience and geography, write clear titles, and avoid one giant document that mixes jurisdictions.

Directory and HRIS integrations supply employee data Harriet can use for answers and automations, within your plan and permissions.

Map vendor-specific HRIS or webhook fields to Harriet so syncs and automations use the right attributes.

Who can run workforce analytics in Harriet depends on roles, features, and any metadata scoping your admins configure.

Step-by-step expectations for adding a new MCP connector in Company settings, syncing tools, and Endpoint AI review when enabled.

Example prompts for workforce analytics and what you need before they work reliably.

Two different ways GitHub and package registries show up in Harriet—sandboxed MCP connectors from npm-style commands vs GitHub-synced skill packages in Endpoint AI.

Field-by-field OAuth setup for sandboxed (uvx / npx) MCP connectors that sign each user in—covers the OAuth client settings, per-user token delivery, standard Google and Microsoft 365 recipes, and using $SECRET_KEY so secrets stay write-only.

Step-by-step checklist for connecting the Asana MCP connector, including the app type, redirect URLs, and OAuth URL overrides that setups most often miss.

Step-by-step checklist for connecting the Atlassian connector — OAuth 2.0 integration, redirect URLs, and the Jira/Confluence scopes to enable.

Step-by-step checklist for connecting the HubSpot MCP connector, including the MCP Auth App, redirect URLs, and the OAuth scope list.

Every skill and MCP connector your team adds is automatically threat-scored and human-reviewed before it can run—Critical risk is blocked from approval until an owner overrides with a documented reason.

Step-by-step Entra app registration and Harriet catalog install for the sandboxed Microsoft 365 MCP connector (pinned npx package, per-user OAuth).

Setup checklist for the Slack MCP connector, and why User Token Scopes (not Bot Token Scopes) determine what Harriet can do in Slack.

Step-by-step checklist for connecting the Todoist connector, including the OAuth scope and the authorize/token URL overrides.

Step-by-step checklist for connecting the Zoom MCP connector — General App on the Zoom Marketplace, scopes for meetings and recordings, and credentials.

Submitted skills are threat-scored automatically and land in the review queue with a risk band; Critical-risk skills are blocked from approval until an account owner overrides with a documented reason.

MCP connectors let Harriet call approved third-party tools through governed skills—create them with New connector in Company settings, sync tools, and control who can use them.

MCP connectors are threat-scored on submission and run in isolated sandboxes; unpinned npx/uvx packages, moving git sources, internal endpoints and hook scripts raise risk, and Critical risk blocks approval until an owner overrides.

When an MCP connector uses one organization API key, request/response hooks can inject the signed-in user's email or employee ID into tool calls and filter results—without changing the upstream server.

Turn a REST API into Harriet MCP tools via OpenAPI, then use request/response hooks for light shaping—or a small wrapper when the API needs email-to-ID joins the hooks cannot perform.

On the MCP connector configuration screen, sync discovered tools then enable only what each audience needs—use per-tool group and role restrictions so power users keep broad access while employees get one or two safe endpoints.

MCP tools are exposed to workflow agents through skills—IT controls which tools are visible, which require confirmation before executing, and which may be used by sub-agents.

MCP servers may use org secrets, per-user OAuth, or API keys—know what Harriet retains, how the connector wizard maps to these patterns, and how approvals work in workflows.

Prefer a workflow with one configurable agent step unless teams need multiple canvas steps, branching, or strict separation of phases. Delegation is always serial—no parallel sub-agents.

Calendar features depend on which calendar integration is enabled and which user has connected their calendar to Harriet.

Agent steps are the core of powerful workflows—choose skills carefully, configure delegation correctly, and always set a sub-agent timeout to avoid stuck runs.

Sub-agents are isolated by design—they only see explicitly delegated skills, cannot access parent workflow data, and cannot delegate further.

The connected user’s calendar scopes and sharing settings determine list, read, and create access.

When expenses are enabled, Harriet can help employees submit or check claims through your connected expense system, within that system’s rules.

Upload Office formats to the Knowledge Base, use them in automations where supported, and use template-based document generation—not full desktop editing in the assistant.

Dedicated public channels give Harriet a clear context so SSO, policies, and docs match the product or team the channel is for—not a generic default.

The embeddable Harriet widget lets visitors chat from your marketing or help sites with scoped knowledge, skills, and ticketing—without signing into Harriet.