Skip to main content
Read an issue, yes. Close it, no. An MCP Policy decides that per team, separately from what the person can do in Linear themselves. Oriant uses the labels Linear puts on its own tools: Read, Write or Destructive. A policy’s risk level says how far up those labels a team may go. The tools and labels above are examples; Oriant shows the real ones per connection. A tool the server gives no label is only allowed under Everything.

Set it up

1

Add Linear

Add Linear under MCP Connections, if it isn’t there already.
2

Make a policy

Open MCP Policies, duplicate the Read only preset and name it after the team, for example “Sales”.
3

Attach it to the team's group

Pick the team’s group from your directory. People added to that group in your identity provider get the policy without any work in Oriant.
4

Put it in order

The first policy in the list that says something about a tool decides it. Place the team’s policy above any broader one that would allow more.
5

Check it

Use View as on a member of the team. Linear should show only Read tools.

What the team sees

Their AI client never lists the Write and Destructive tools, so Claude doesn’t try them. If a call reaches Oriant anyway, it is refused, never sent to Linear, and shows in the call log with the policy that refused it.

Go further

  • Allow one write tool, such as save_comment, with a tool exception on the policy.
  • Keep the team inside one Linear team with an argument rule.
  • Give a different level on other connections, such as Slack, in the same policy.
Last modified on November 9, 2026