Flexport Permission-Aware Access Broker

Overview

Flexport has two access concepts that must not be conflated: OAuth clients select endpoint resources, while MCP tools document allowed account roles. API keys are broad across endpoints and should not be described as selectively scoped.

Prerequisites

• Workload-to-outcome inventory and accountable owners
• Current REST endpoint resource and MCP tool permission documentation
• Credential registry with environment and rotation metadata

Instructions

Step 1: Map business outcomes

List reads, document changes, invoice work, booking commitments, and MCP tools by workload.

Step 2: Assign separate credentials