NetSuite MCP role permissions: a least-privilege role for Claude and ChatGPT

In short

• A NetSuite MCP role is the role a user picks when an AI client such as Claude or ChatGPT connects to the NetSuite AI Connector Service, Oracle’s MCP (Model Context Protocol) server. The AI acts as that user and sees only what the role sees.
• Two permissions are mandatory, on the Setup subtab: MCP Server Connection and Log in using OAuth 2.0 Access Tokens. The Administrator role and “roles that have full permissions” are refused.
• The REST Web Services permission reveals the record tools, including the only two write tools. Report tools and ns_runCustomSuiteQL (queries in SuiteQL, NetSuite’s SQL dialect) need nothing extra.
• Read-only comes from the role; Oracle documents no read-only switch on the connector. For finance: no REST Web Services permission, View only, and no other role with MCP Server Connection for those users.

Who this is for

NetSuite admins and IT or security reviewers: finance wants Claude on NetSuite, the AI must not write to the ledger, and the auditor wants the role justified. As of NetSuite 2026.2 (September 2026); SuiteWorld 2026 (October 25-28) may change details.

This guide draws on Oracle’s documentation and practitioner demos. Run the tests below in a sandbox before you rely on the role.

What you need

• An Administrator login to create and assign roles.
• At Setup > Company > Enable Features, SuiteCloud subtab: Server SuiteScript, OAuth 2.0, and REST Web Services (the feature is required to install the SuiteApp).
• The MCP Standard Tools SuiteApp installed (setup guide).
• Recommended: a sandbox to test. NetSuite OneWorld only if you restrict by subsidiary.

How the AI gets its access

The AI works as the signed-in user, in one role. Oracle: the Standard Tools “don’t provide any additional access beyond what your NetSuite role allows.”

Two gates apply. A tool is offered only if the role holds every permission Oracle lists for that tool. What the tool can then read or change depends on the role’s normal permissions, so a visible tool can still fail.

The consent screen at sign-in names a role and has a Choose Another Role link. A user can connect with any role they hold that carries both mandatory permissions, so read-only holds only if the AI role is their only such role.

Global Permissions. If this feature is on, open each AI user’s employee record, Access subtab, Global Permissions subtab. Oracle combines these with the role’s permissions, and they win on conflict “even if global permissions are at a lower level.” A global Edit there would widen a View-only AI role.

Which permissions does the NetSuite MCP role need?

Path: Setup > Users/Roles > Manage Roles, edit the role, Permissions subtab, which has Transactions, Reports, Lists, Setup and Custom Record subtabs.

MCP Server Connection is the gate: removing it is Oracle’s documented way to turn the connector off for a role.

• IDs and levels come from Oracle’s Permission Names and IDs table. The first three accept only None or Full; Perform Search accepts None, View or Full. Prolecto’s walkthrough also shows Full as the only choice for MCP Server Connection (10:56).
• Not Log in using Access Tokens (ADMI_LOGIN_OAUTH), the token-based authentication (TBA) permission.
• The REST Web Services feature stays on for the SuiteApp. The permission is a per-role choice: Oracle requires it only for users who should “create, retrieve, and update NetSuite records.”

Which roles are refused: Administrator, Full Access and possibly Core Administration Permissions

Oracle refuses the Administrator role and “roles that have full permissions to access NetSuite features”, in case the AI client’s security is compromised. It does not define that second group. Two cases matter:

• Full Access, a standard role deprecated in 2021.1. JR Tallman’s ChatGPT tutorial says it will not work (00:55).
• Core Administration Permissions (CAP), a role checkbox that makes a role “similar to the standard Administrator role” (Oracle). Oracle does not say whether CAP blocks the connection, and the two community reports conflict. Leave it unchecked either way: it is the opposite of least privilege.

The two reports: an r/Netsuite user (August 2026) fixed failing MCP roles by unchecking CAP, but that role also held OAuth 2.0 Authorized Applications Management at Full. In Oasis Solutions’ November 2025 demo, ChatGPT connects with a customized Controller role that has CAP (09:35).

Permission-to-tool matrix

MCP Standard Tools has 14 tools and 3 MCP Apps. Per Oracle, only ns_createRecord and ns_updateRecord write, and Oracle lists no delete tool. Tool by tool: NetSuite MCP Standard Tools explained.

What still limits each tool:

• Record tools inherit REST Web Services limits: a field that is read-only in REST stays read-only. A create or update succeeds only if the role’s level on that record type allows it.
• Report tools run “any report that you have access to based on your current permissions”; SuiteQL results depend on the role’s permissions too.
• For ns_getSuiteQLMetadata, Oracle’s overview table shows no permission but its tool page lists REST Web Services (Full). Follow the tool page.
• The SuiteApp is managed and its tools “may be modified over time.” Recheck this matrix after updates.

How to make a read-only NetSuite AI role

Oracle documents no read-only mode and no per-tool switch (“You cannot activate or deactivate individual tools”). Read-only must come from the role, one of two ways.

Option 1, strict: no REST Web Services permission. Per Oracle’s tool pages, the four record tools, ns_getSuiteQLMetadata and Record Selector are hidden; no standard write tool is offered. In Prolecto’s demo, record tools appeared only after the presenter added the permission (36:43).

The cost: Oracle says ns_runCustomSuiteQL calls ns_getSuiteQLMetadata “to confirm the record structure” first. In Prolecto’s demo without that permission, ChatGPT’s first SuiteQL query used a wrong column, then corrected itself (25:38).

Option 2, soft: REST Web Services plus View-only record permissions. All 14 tools appear (with Perform Search), and writes fail on permission, as in Prolecto’s refused “create vendor” request (38:39). The cost: one later mistake, such as Edit on Vendors, silently turns writes on.

For “the AI never writes to the ledger”, combine three layers: Option 1, every Transactions permission at View or absent, and no other role with MCP Server Connection for the AI users.

A client-side layer. In Claude, each user can set each NetSuite tool to Always allow, Needs approval or Blocked on the connector’s page (Customize > Connectors), and on Team and Enterprise plans the organization Owner (often not the NetSuite admin) can limit which actions the connector can take across the organization. This narrows, and never replaces, the role.

Recipe A: read-only role for finance analysts

For finance and financial planning and analysis (FP&A) users, such as accounts payable (AP) and accounts receivable (AR) analysts. Oracle publishes principles, not a minimum role: “Prefer read-only or low-impact MCP tools during initial evaluation.”

Start from New if an auditor will review the role. A customized standard role “inherits all of the standard role’s permissions to start” (Oracle), each to cut or justify. Prolecto customized AP Clerk, removed most permissions and set the rest to View, except Find Transaction (09:24).

The Companion SuiteApp’s AI Companion View Only role has no published permission list. Before copying it, check it for REST Web Services (if present, it is Option 2), Core Administration Permissions, and Transactions above View.

1. Go to Setup > Users/Roles > Manage Roles > New. Name the role (for example “AI Finance Analyst, read-only”) and select the center type, which “sets default permissions” (Oracle): review them in the steps below. Leave Core Administration Permissions unchecked.
2. Setup: MCP Server Connection (Full), Log in using OAuth 2.0 Access Tokens (Full). No REST Web Services.
3. Lists: Perform Search (View), plus View on the lists the use case needs.
4. Reports and Transactions: View only, on what the use case needs.
5. Custom Record: nothing unless needed. Set restrictions (see Restricting scope) and save.
6. Make it the only AI role. At Reports > Saved Searches > All Saved Searches > New, choose Role, criteria Permission is MCP Server Connection. Remove that permission from any other listed role your AI users hold. Rerun after every role change.
7. Assign the role on the employee’s Access subtab, Roles subtab. If you assign it during the user’s session, they must log out and back in before it is offered (Prolecto, 22:41).
8. If Global Permissions is on, check each AI user’s global permissions for anything above View.
9. At Customization > Scripting > Custom Tools (Administrator role), deactivate toolsets finance does not need.
10. Users connect with https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools (account ID format), not /all. This is a convenience, not a control: Oracle says “End users can scope” tools by namespace.

Another route, and one trap. Anchor Group copies a customized role instead (Save As, 02:28), then sets every row on the five permission subtabs to View (03:09). Its role is for Sonar, a Suitelet-based AI tool, not the AI Connector.

The trap is Anchor’s rule for rows with no View level: delete them (03:23). On an AI Connector role, that deletes MCP Server Connection and Log in using OAuth 2.0 Access Tokens, which accept only Full, and the role can no longer connect.

For Recipe A, keep Full only on those two rows and delete every other row with no View level, REST Web Services included.

Example: AP/AR analyst role

Illustrative. IDs and valid levels are from Oracle’s Permission Names and IDs table; which reports each report permission opens was not checked.

Recipe B: read/write operations role

Example: an AP assistant that creates vendors. Build a separate role; never widen Recipe A to fix a failed prompt.

1. Open the Recipe A role, change the Name, choose Save As. Add REST Web Services (Full).
2. Raise only the target record types, such as Vendors (LIST_VENDOR) to Create or Edit.
3. Keep Pay Bills, Customer Payment and Make Journal Entry at View or absent: Oracle’s risk page cites “making payments or granting approvals” as unintended actions.
4. Review scripts and workflows on those records (Customization > Scripting > Scripted Records).
5. Keep write tools on “Needs approval” in the client, and ask for an External ID on creates (Oracle: “always set the External ID”).
6. Assign it only to users who need writes: a user holding both roles can pick either at sign-in.

Watch the prompt library: Companion prompts include “Pay Bills via ACH - Pay Specific Vendor” and “Create Intercompany Journal Entry.” A role that makes them work is high-impact by Oracle’s own risk list.

Restricting scope beyond permissions

The tools use “the same access controls as the NetSuite UI”, so role restrictions apply to AI sessions.

• Subsidiaries (OneWorld): Subsidiary Restrictions: All, Active, User Subsidiary (default) or Selected. Leave Allow Cross-Subsidiary Record Viewing unchecked.
• Department, class, location: Restrictions subtab, a Segment and a level such as “own and subordinates only”. Leave Allow Viewing unchecked.
• Employees: Employee Restrictions filter records by the employee, sales rep and supervisor fields.
• Custom records: the Restrict column limits the role to records the user or subordinates created.

In Prolecto’s demo, a SuiteQL answer for “the most recent vendor” covered only the role’s one subsidiary (29:17). After a restriction change, Oracle says users “must log out of NetSuite and log in again” (for the UI). Reconnect the AI client too; Oracle does not document how an open AI session picks up the change.

Custom tools and toolsets

A custom tool’s SDF (SuiteCloud Development Framework) toolset object can declare a <permissions> block. It sets “the visibility of the tool” and grants nothing: users only do what “their NetSuite role allows” (Oracle).

A toolset with no <permissions> block (Oracle’s SuiteQL sample has none) is visible to every user who can connect, if it is exposed (<exposetoaiconnector>T</exposetoaiconnector>, default F) and active.

“No write tool” in Recipe A covers the Standard Tools only. Oracle’s sample customer tools create and update records, so for custom tools the View-only levels are the barrier. More: Build a custom MCP tool.

Test the role before going live

1. In a sandbox, assign the role to yourself (or sign in as a test employee who holds it), then use Change Roles (hover over your name, top right) to browse as that role.
2. Connect the AI client with that role (namespaced URL from step 10) and ask for its list of NetSuite tools. With Recipe A, per Oracle’s tool pages:
   • Expected: the six report tools, ns_runCustomSuiteQL, ns_listSavedSearches, ns_runSavedSearch, ns_prompt_library_app, ns_report_filters_app.
   • Absent: ns_createRecord, ns_updateRecord, ns_getRecord, ns_getRecordTypeMetadata, ns_getSuiteQLMetadata, ns_selector_app.
3. Ask for something forbidden (“create a vendor named Test”). With Recipe A, expect no create tool; if ns_createRecord is offered, remove REST Web Services from the role. With REST Web Services, expect a permission error, as in Luxent’s demo, where Claude says the role lacks create-vendor permission (12:55).
4. Ask for what the role must not see: transactions of a subsidiary outside its restriction, and a SuiteQL query on a record type it has no permission on (for example employees). Expect no rows or an error; Oracle does not document which, so record it.
5. Compare one report run in NetSuite and through the AI (checking the numbers).
6. Check the integration record (Setup > Integration > Manage Integrations), Execution Log tab, AI Connector Service (MCP) subtab: user email, method, HTTP status (kept 7 days in sandbox, 21 in production).
7. Keep the evidence: date, role, tool list, prompts, results and log rows.

What to give the auditor

• The role’s permissions. At Setup > Users/Roles > Show Role Differences (needs Bulk Manage Roles), pick the AI role as Base Role and any role in Compare To, clear Only Show Differences, click Show, then export CSV or XLSX.
• Every role with MCP Server Connection: the role search from Recipe A step 6. Its Permission Change, Permission Change Date and Permission Change Level fields give the history.
• Who holds the AI role: an employee saved search on the Role field.
• Authorized applications: Setup > Users/Roles > OAuth 2.0 Authorized Applications.
• Execution log extracts, with a plan for its 21-day retention (governance guide).
• Claude connector tool settings (from the Claude Owner) and your test evidence.

Nuage’s advice is to show auditors the permission export, not a claim of read-only, with no Create, Edit or Full in it (06:41). That test cannot pass on an MCP role: the two connection permissions (and REST Web Services under Option 2) accept only Full.

A control statement to adapt:

AI clients act as the signed-in user in role [AI Finance Analyst, read-only]. The role has no
REST Web Services permission, so Oracle's MCP Standard Tools offer no create or update tool.
Every Transactions permission is View or absent. No other role these users hold has MCP Server
Connection (checked after each role change). Sandbox tests on [date] confirmed both.

Sandbox and production

• “Each time the sandbox is refreshed, users must authorize applications explicitly in the sandbox.”
• A refresh copies “all configurations, data, user passwords, and customizations” from production: a sandbox-only role is lost, and the sandbox holds real data.
• Tim Dietrich’s guide suggests “read-only Production access with edit capabilities only in Sandbox.” Keep Recipe B there until reviewed.
• Roles are per account. If write tools show in one account only, compare the role exports from both.

One NetSuite user per person

Consent is per user, the execution log records each user’s email, and System Notes’ Set By shows who initiated a change. A shared “AI user” erases that trail. Some guides suggest dedicated MCP users (Tim Dietrich); if you create them, keep one per person, not one shared account.

Permissions you do not need (and tutorials that add them)

• OAuth 2.0 Authorized Applications Management at Full (JR Tallman, 01:38). Oracle: it “Is primarily for the Administrator role,” and its holders “can’t access RESTlets, REST web services, and SuiteAnalytics Connect using OAuth 2.0.” Not required.
• Perform Search at Full (Tim Dietrich’s guide): Oracle’s tool page asks for View.
• REST Web Services by default: Oracle’s FAQ lists it with the mandatory two, then says it is “required for some of its tools.” Add it only for record tools.

Common problems

FAQ

How do I enforce read-only access for everyone using Claude?

Assign Recipe A (no REST Web Services permission, View-only record permissions) to every AI user, and remove MCP Server Connection from every other role they hold. Recheck with a role saved search after each role change. Claude Team and Enterprise owners can also block write tools organization-wide.

Can a user pick a more powerful role when connecting Claude?

Yes, if they hold one. The consent screen has a Choose Another Role link, and any role with the two mandatory permissions can connect, except Administrator and roles with full permissions. Keep MCP Server Connection on the AI role only.

Does the connector give more access than the role allows?

No. Per Oracle, tools “can only access data you’re allowed to see when logged in with this role.” Surprises come from REST Web Services, which exposes record tools for every REST-available record the role’s permissions allow.

Can the AI read salaries or other subsidiaries’ data?

Only if the role can: Oracle says queries “respect your NetSuite role’s permissions.” Leave employee and payroll permissions off the AI role, restrict subsidiaries, and run the read tests above.

Which standard role should I start from?

Oracle documents no minimum role. Start from New for an audited role, or customize a standard role close to the use case (Prolecto used AP Clerk) and cut it to View. AI Companion View Only is another reference once you have checked its permissions.

Sources

Oracle NetSuite Help Center (read 2026-09-26):

• AI Connector: Required Features and Permissions; Connect; FAQ; Risks, Controls, and Mitigation
• MCP Standard Tools: SuiteApp; Installing; Available Tools; Record Tools; Report Tools; Saved Search Tools; ns_runCustomSuiteQL; ns_getSuiteQLMetadata; MCP Apps; Best Practices
• Companion: Installing, and its roles; Procure to Pay prompts; Record to Report prompts
• Permissions: Permission Names and IDs; Permissions for Searches
• Roles: Creating Roles; Setting Permissions; Subsidiaries; Department, Class, Location; Employee Restrictions; Core Administration Permissions; Full Access Role (Deprecated); Global Permissions; Switching Roles
• Audit: Show Role Differences; Searches to Audit Roles; Searches by Employee; Defining a Saved Search; System Notes for AI changes
• OAuth 2.0: Roles; Consent; Authorized Applications
• Custom tools: XML definitions; toolset object; Managing Custom Tools; Error Messages; Scripted Records
• Sandbox: Not copied; Refresh

Oracle GitHub: MCP Sample Tools

Anthropic: Use connectors to extend Claude’s capabilities; Get started with connectors (tool permissions)

Third parties: Prolecto Resources video (December 2025); JR Tallman, Claude and ChatGPT tutorials; videos by Anchor Group (July 2026), Luxent (March 2026), Nuage (August 2026) and Oasis Solutions (November 2025); Tim Dietrich, NetSuite AI Connector Guide; r/Netsuite thread (August 2026)

Related guides

• AI and NetSuite in 2026: every option.
• Connect NetSuite to Claude and ChatGPT: the MCP setup.
• MCP Standard Tools explained: what each tool does.
• Governing AI access: logs, audit, revocation.
• AI Connector errors: causes and fixes.
• Custom MCP tools: the toolset format.

About SeamSet: if your team needs NetSuite itself to change (a screen, an approval step, a scheduled export) rather than an AI writing records, SeamSet builds it from a plain-language request: sandbox first, tested, documented, reviewed and approved by your NetSuite admin, with audit and rollback. For NetSuite admins.