docs: update AI access management navigation for the new AI section

product/admin/ai-clients.mdx

@@ -8,7 +8,7 @@
 {/* Editor Refresh: 2026-05-08 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 An **AI client** is any registered AI agent that talks to C1 MCP — Claude Desktop, Claude Code, Cursor, ChatGPT, Copilot, custom agents, and so on. This page covers how clients are registered, the lifecycle states they move through, the controls you have over them, and the tenant policy that governs which client types are allowed in your tenant.
@@ -41,7 +41,7 @@
 | **Owner** | C1 user the client is bound to |
 | **State** | Active / hidden / closed / deleted (see lifecycle below) |
 | **Last used** | Timestamp of the last tool call |
 | **Toolsets** | Toolsets currently accessible to the client (via the user's access profiles) |
 
 You can filter by any column. Click a client to open its detail panel.
 
@@ -73,7 +73,7 @@
 
 <Steps>
 <Step>
-Go to **Settings > AI Connections**.
+Go to **AI > C1 Gateway > Settings**.
 </Step>
 <Step>
 Edit **Allowed client types**.

product/admin/c1-mcp.mdx

@@ -38,10 +38,10 @@
 
 <Steps>
 <Step>
-Navigate to **Settings** > **AI connections**.
+Navigate to **AI** > **C1 Gateway** and open the **Settings** tab.
 </Step>
 <Step>
-At the top of the **AI connections** page, click **Edit** and toggle **Enable AI connections** to on.
+Find **AI connections**, click **Edit**, and toggle **Enable AI connections** to on.
 </Step>
 <Step>
 Click **Save**.
@@ -78,7 +78,7 @@
 </Steps>
 
 <Note>
 If you configure IP restrictions, AI assistants will only work from the specified IP ranges. This is useful for restricting usage to corporate networks or VPNs.
 </Note>
 
 ## Connect an AI assistant
@@ -110,7 +110,7 @@
     4. Save and restart Claude Desktop.
   </Tab>
   <Tab title="Claude Code">
     1. From your terminal, add the C1 MCP server using the `claude mcp add` command:
 
        ```bash
        claude mcp add --transport http c1 https://<your-tenant>-mcp.conductor.one/v1
@@ -126,7 +126,7 @@
     </Tip>
   </Tab>
   <Tab title="Codex">
     1. From your terminal, add the C1 MCP server using the `codex mcp add` command:
 
        ```bash
        codex mcp add c1 --url https://<your-tenant>-mcp.conductor.one/v1
@@ -186,7 +186,7 @@
 | `describe_object_filters` | Get filterable fields for an object type |
 | `get_object_schema` | Get the JSON schema for an object type |
 
 ## Queryable objects
 
 AI assistants can query 20 different object types across your C1 tenant.
 
@@ -229,7 +229,7 @@
 
 | Object | Description |
 | :--- | :--- |
 | `RequestCatalog` | Collections of requestable entitlements in an Access Profile |
 | `Webhook` | Event notification configurations |
 | `Directory` | Account sync configurations |
 | `ProfileType` | Attribute mapping configurations |
@@ -304,7 +304,7 @@
 
 ### Admin management
 
-Super Admins can navigate to **Settings** > **AI connections** to view and revoke all connections across the tenant.
+Super Admins can navigate to **AI** > **C1 Gateway** > **Connected clients** to view and revoke all connections across the tenant.
 
 ## System log events
 
@@ -395,7 +395,7 @@
   </Accordion>
 
   <Accordion title="How do I restrict where AI connections can be used?">
     Administrators can configure IP allow lists in **Settings** > **IP Allowlist** > **AI connections** to restrict access to specific IP ranges. This is useful for limiting usage to corporate networks or VPNs.
   </Accordion>
 
   <Accordion title="Can I see what queries the AI is making?">

product/admin/enable-ai-access-management.mdx

@@ -8,7 +8,7 @@
 {/* Editor Refresh: 2026-05-08 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 AIAM lets you govern which AI clients can call which tools on your behalf, and which end users are allowed to use them. This page walks a Super Admin through turning AIAM on for the tenant and setting the tenant-wide defaults that apply to every MCP server, tool, and AI client you register afterward.
@@ -17,14 +17,14 @@
 
 ## Enable AIAM for your tenant
 
 Enabling AIAM exposes the AIAM surfaces (MCP servers, tools, AI clients, AIAM audit log) to admins. It does **not** automatically grant any end user access to any tool — every tool still has to be approved, added to a toolset, and bound to an access profile before it becomes requestable.
 
 <Steps>
 <Step>
 Log in to your C1 tenant as a Super Admin.
 </Step>
 <Step>
-Navigate to **Settings > AI Connections**.
+Navigate to **AI > C1 Gateway** and open the **Settings** tab.
 </Step>
 <Step>
 Click **Edit AI Connections**.
@@ -58,7 +58,7 @@
 
 <Steps>
 <Step>
-In **Settings > AI Connections**, find **Allowed client types**.
+In **AI > C1 Gateway > Settings**, find **Allowed client types**.
 </Step>
 <Step>
 Check the boxes for the types you want to permit.
@@ -74,7 +74,7 @@
 
 ### Default tool classification
 
 When C1 discovers a new tool on a registered MCP server, it assigns the tool this initial state. Until an admin reviews and approves the tool, it cannot be added to a toolset and end users cannot request it.
 
 - **State**: Pending Review / Unset (recommended — keeps every newly-discovered tool out of end-user reach until you've reviewed it)
 - **Classification**: Unclassified (recommended)
@@ -83,7 +83,7 @@
 
 <Steps>
 <Step>
-In **Settings > AI Connections**, find **Default tool classification**.
+In **AI > MCP > Settings**, find **Default tool classification**.
 </Step>
 <Step>
 Select the state and classification to apply to newly-discovered tools.
@@ -95,13 +95,13 @@
 
 ### Require tool approval
 
 When on, every newly-discovered tool starts in **Pending Review** and must be approved by an admin before it can be added to a toolset. When off, tools become available to be added to toolsets immediately on discovery.
 
 - **Default**: On
 - **Recommended**: On for production tenants. Off is appropriate only for sandbox tenants where you're testing the end-to-end flow.
 
 <Note>
 Turning this off does not bypass access profile approval — end users still go through the access profile's approval policy when they request a toolset.
 </Note>
 
 ### Client lifecycle inactivity policy
@@ -118,7 +118,7 @@
 
 <Steps>
 <Step>
-In **Settings > AI Connections**, find **Client lifecycle**.
+In **AI > C1 Gateway > Settings**, find **Client lifecycle**.
 </Step>
 <Step>
 Set the inactivity threshold for each state.
@@ -141,7 +141,7 @@
 
 <Steps>
 <Step>
-In **Settings > AI Connections**, find **Emergency kill switch**.
+In **Settings > System management**, find **Emergency kill switch**.
 </Step>
 <Step>
 Click **Disable all AI access**.

product/admin/mcp-server/apollo.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Apollo MCP server lets you govern access to Apollo — contacts, accounts, and other sales data — as tools your AI clients can call through C1.
@@ -73,9 +73,9 @@
 
 After you register the server, C1 runs tool discovery against Apollo. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call an Apollo tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Apollo credentials when an approved user successfully calls an Apollo tool from their AI client.

product/admin/mcp-server/auth0.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Auth0 MCP server lets you govern access to Auth0 — users, connections, applications, roles, and other tenant data managed through the Auth0 Management API — as tools your AI clients can call through C1.
@@ -78,9 +78,9 @@
 
 After you register the server, C1 runs tool discovery against Auth0. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call an Auth0 tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Auth0 credentials when an approved user successfully calls an Auth0 tool from their AI client.

product/admin/mcp-server/azure-devops.mdx

@@ -2,7 +2,7 @@
 title: Set up the Azure DevOps MCP server
 description: Connect Azure DevOps to C1 with a personal access token or a Microsoft Entra token, then register the MCP server and govern its tools.
 og:title: Set up the Azure DevOps MCP server
 og:description: Connect Azure DevOps to C1 with a personal access token or a Microsoft Entra token, then register the MCP server and govern its tools.
 sidebarTitle: Azure DevOps
 ---
 
@@ -87,27 +87,27 @@
 </Step>
 </Steps>
 
 ## Option 2: Use a Microsoft Entra token
 
 A Microsoft Entra access token authenticates every user as one shared identity. Use this when your organization standardizes on Microsoft Entra ID for access to Azure DevOps.
 
 ### Obtain a Microsoft Entra token
 
 <Steps>
 <Step>
 [Register an application in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app), or use an existing one.
 </Step>
 <Step>
 Grant the application access to the Azure DevOps resource (`499b84ac-1321-427f-aa17-267ca6975798`) and obtain an access token issued for that resource.
 </Step>
 <Step>
 Copy the access token. Treat it as a high-value credential. Microsoft Entra access tokens are short-lived.
 </Step>
 </Steps>
 
 ### Register the server with a Microsoft Entra token
 
 With your Microsoft Entra access token ready, register the server and provide your credentials.
 
 <Steps>
 <Step>
@@ -117,7 +117,7 @@
 Enter your **organization** slug when prompted.
 </Step>
 <Step>
 When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your Microsoft Entra access token.
 </Step>
 <Step>
 Save your changes. C1 starts a sync that discovers the tools the Azure DevOps server exposes.
@@ -134,9 +134,9 @@
 
 After you register the server, C1 runs tool discovery against Azure DevOps. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call an Azure DevOps tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Azure DevOps credentials when an approved user successfully calls an Azure DevOps tool from their AI client.
@@ -145,5 +145,5 @@
 ## Manage your Azure DevOps credentials
 
 - **Rotate a personal access token** by creating a new token in Azure DevOps under **User settings** > **Personal access tokens** and updating it in C1, then revoking the old token. Set an expiration so it rotates on a schedule.
 - **Refresh a Microsoft Entra token** before it expires by obtaining a new access token for the Azure DevOps resource and updating it in C1.
 - **Adjust access** by editing the token's scopes in Azure DevOps or the application's permissions in Microsoft Entra ID.

product/admin/mcp-server/bitbucket.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Bitbucket MCP server lets you govern access to Bitbucket Cloud — repositories, pull requests, issues, pipelines, projects, and workspace data — as tools your AI clients can call through C1.
@@ -124,11 +124,11 @@
 
 ### Create an API token
 
 Create an API token in your Atlassian account so C1 can authenticate to the Bitbucket API.
 
 <Steps>
 <Step>
 In your Atlassian account settings, create an **API token** scoped for Bitbucket access. For details, see Bitbucket's [API tokens](https://support.atlassian.com/bitbucket-cloud/docs/api-tokens/) documentation.
 </Step>
 <Step>
 Copy the generated token. Treat it as a high-value credential.
@@ -166,9 +166,9 @@
 
 After you register the server, C1 runs tool discovery against Bitbucket. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Bitbucket tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Bitbucket credentials when an approved user successfully calls a Bitbucket tool from their AI client.

product/admin/mcp-server/box.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Box MCP server lets you govern access to Box — files, folders, users, groups, and other content data — as tools your AI clients can call through C1.
@@ -100,9 +100,9 @@
 
 After you register the server, C1 runs tool discovery against Box. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Box tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Box credentials when an approved user successfully calls a Box tool from their AI client.

product/admin/mcp-server/buildkite.mdx

@@ -1,43 +1,43 @@
 ---
 title: Set up the Buildkite MCP server
 description: Create a Buildkite API access token, then register the Buildkite MCP server in C1 and govern the tools it exposes.
 og:title: Set up the Buildkite MCP server
 og:description: Create a Buildkite API access token, then register the Buildkite MCP server in C1 and govern the tools it exposes.
 sidebarTitle: Buildkite
 ---
 
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Buildkite MCP server lets you govern access to Buildkite — organizations, pipelines, builds, jobs, agents, and clusters — as tools your AI clients can call through C1.
 
 Buildkite authenticates with an API access token. A single token authenticates everyone, so all tool calls reach Buildkite as one shared identity.
 
 ## How C1 connects to Buildkite
 
 C1 hosts the Buildkite MCP server, so your users' AI clients only ever see MCP tools — they never call Buildkite directly. When an AI client calls one of these tools, C1 makes the matching request to the Buildkite API using the credentials you configure here, then returns the result to the AI client.
 
 The credentials you set up below are what C1 uses to call Buildkite on your users' behalf.
 
 ## Before you begin
 
 - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
 - A Buildkite account that can create an API access token with access to the organizations you want to govern.
 
 <Note>
 If you don't see **Buildkite** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
 </Note>
 
 ## Create a Buildkite API access token
 
 Create an API access token in Buildkite so C1 can authenticate to the Buildkite API.
 
 <Steps>
 <Step>
 Sign in to Buildkite and open **Personal Settings** > **API Access Tokens**. For details, see Buildkite's [Managing API access tokens](https://buildkite.com/docs/apis/managing-api-tokens) documentation.
 </Step>
 <Step>
 Select **New API Access Token**.
@@ -49,19 +49,19 @@
 Select the **REST API scopes** the token needs for the operations you plan to govern, such as reading builds, pipelines, and agents.
 </Step>
 <Step>
 Create the token and copy it. Buildkite shows the token only once.
 </Step>
 </Steps>
 
 For a shared production setup, create the token from a dedicated service account so activity is attributable to C1 rather than a person.
 
 ## How Buildkite credentials are shared
 
 Every user's tool calls use the one API access token you provided, so Buildkite sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated service account so activity is attributable to C1 rather than a person.
 
 For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication).
 
 ## Register the Buildkite MCP server in C1
 
 With your API access token ready, register the server and provide your credentials.
 
@@ -73,23 +73,23 @@
 When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your API access token.
 </Step>
 <Step>
 Save your changes. C1 starts a sync that discovers the tools the Buildkite server exposes.
 </Step>
 </Steps>
 
 ## Discover and govern tools
 
 After you register the server, C1 runs tool discovery against Buildkite. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Buildkite tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Buildkite credentials when an approved user successfully calls a Buildkite tool from their AI client.
 </Note>
 
 ## Manage your Buildkite credentials
 
 - **Rotate the API access token** by creating a new token on your Buildkite **API access tokens** page and updating it in C1, then revoking the old token.
 - **Adjust access** by editing the token's organizations and REST API scopes in Buildkite.

product/admin/mcp-server/confluence.mdx

@@ -9,12 +9,12 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Confluence MCP server lets you govern access to Confluence Cloud — pages, blog posts, spaces, comments, attachments, whiteboards, groups, and users — as tools your AI clients can call through C1.
 
 Confluence uses per-user OAuth, which is recommended: each person authorizes with their own Atlassian account, so every tool call runs under that user's identity and permissions.
 
 ## How C1 connects to Confluence
 
@@ -25,19 +25,19 @@
 ## Before you begin
 
 - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
 - An Atlassian account that can create an OAuth 2.0 integration. See Atlassian's [OAuth 2.0 (3LO) apps guide](https://developer.atlassian.com/cloud/confluence/oauth-2-3lo-apps/).
 
 <Note>
 If you don't see **Confluence** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
 </Note>
 
 ## Create an Atlassian OAuth 2.0 integration
 
 With per-user OAuth, you register one Atlassian OAuth 2.0 (3LO) integration and each user authorizes individually. This keeps every action attributable to the user who took it, with only the access that user already has in Confluence.
 
 <Steps>
 <Step>
 Sign in to the Atlassian Developer Console with your Atlassian account. For the full walkthrough, see Atlassian's [OAuth 2.0 (3LO) apps guide](https://developer.atlassian.com/cloud/confluence/oauth-2-3lo-apps/).
 </Step>
 <Step>
 Select **Create** > **OAuth 2.0 integration**, enter a recognizable name such as `C1`, then select **Create**.
@@ -61,7 +61,7 @@
 
 ## How Confluence credentials are shared
 
 With per-user OAuth, each user authorizes with their own Atlassian account, so tool calls run under that user's Confluence identity and inherit only the access they already have. Atlassian attributes each action to the individual user.
 
 For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication).
 
@@ -77,7 +77,7 @@
 When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your integration's **client ID** and **client secret**.
 </Step>
 <Step>
 Save your changes. The first time a user calls a Confluence tool from their AI client, they're prompted to connect their Atlassian account.
 </Step>
 </Steps>
 
@@ -85,9 +85,9 @@
 
 After you register the server, C1 runs tool discovery against Confluence. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Confluence tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Confluence credentials when an approved user successfully calls a Confluence tool from their AI client.
@@ -95,5 +95,5 @@
 
 ## Manage your Confluence credentials
 
 - **Rotate the OAuth client secret** in the Atlassian Developer Console under your integration's **Settings** tab, then update the secret on the server's authentication settings in C1.
 - **Adjust access** by editing the integration's Confluence scopes on the **Permissions** tab in the Atlassian Developer Console.

product/admin/mcp-server/crowdstrike.mdx

@@ -85,9 +85,9 @@
 
 After you register the server, C1 runs tool discovery against CrowdStrike. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a CrowdStrike tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your CrowdStrike credentials when an approved user successfully calls a CrowdStrike tool from their AI client.

product/admin/mcp-server/datadog.mdx

@@ -1,41 +1,41 @@
 ---
 title: Set up the Datadog MCP server
 description: Create your Datadog API and application keys, then register the Datadog MCP server with C1 and configure authentication.
 og:title: Set up the Datadog MCP server
 og:description: Create your Datadog API and application keys, then register the Datadog MCP server with C1 and configure authentication.
 sidebarTitle: Datadog
 ---
 
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Datadog MCP server lets you govern access to the Datadog observability platform — metrics, monitors, dashboards, logs, security signals, incidents, and more — as tools your AI clients can call through C1.
 
 Datadog authenticates with two credentials that work together:
 
 - An **API key** identifies your organization to Datadog.
 - An **application key** authorizes a user or role to read and write data.
 
 Most Datadog endpoints need both, so you'll create each one in Datadog and then provide them to C1 when you register the server.
 
 ## How C1 connects to Datadog
 
 C1 hosts the Datadog MCP server, so your users' AI clients only ever see MCP tools — they never call Datadog directly. When an AI client calls one of these tools, C1 makes the matching request to the Datadog REST API using the credentials you configure here, then returns the result to the AI client.
 
 The credentials you set up below are what C1 uses to call Datadog on your users' behalf.
 
 ## Before you begin
 
 - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
 - You need a Datadog user with permission to manage keys, typically the **Datadog Admin** role.
 - Know which Datadog site your organization uses. See [Find your Datadog site](#find-your-datadog-site).
 
 ## Find your Datadog site
 
 Datadog hosts each organization on a regional site with its own API host. You'll select this site when you register the server in C1. To find yours, match the host in your browser's address bar while you're signed in to Datadog.
 
 | Site | Web host | API host |
 | :--- | :--- | :--- |
@@ -48,15 +48,15 @@
 | US1-FED | `app.ddog-gov.com` | `api.ddog-gov.com` |
 | US2-FED | `us2.ddog-gov.com` | `api.us2.ddog-gov.com` |
 
 For more detail, see Datadog's [Getting Started with Datadog sites](https://docs.datadoghq.com/getting_started/site/).
 
 ## Create a Datadog API key
 
 Create an API key in your Datadog organization to identify it to C1.
 
 <Steps>
 <Step>
 Sign in to Datadog as a user who can manage API keys.
 </Step>
 <Step>
 Go to **Organization Settings** > **API Keys**.
@@ -71,9 +71,9 @@
 
 API keys are organization-level. They don't expire by default and aren't tied to a specific user.
 
 ## Create a Datadog application key
 
 Create an application key to authorize C1 to call the Datadog API.
 
 <Steps>
 <Step>
@@ -83,26 +83,26 @@
 Select **New Key** and give it a recognizable name such as `C1`.
 </Step>
 <Step>
 **Optional.** Under **Authorization Scopes**, select **Limit Authorization Scopes** and grant only the scopes your tools need. The right scopes depend on which Datadog tools you plan to expose — read-only tools need scopes like `dashboards_read` and `monitors_read`, while tools that take action (such as creating monitors or updating incidents) need the corresponding write scopes. For a full list of available scopes, see Datadog's [API and application keys](https://docs.datadoghq.com/account_management/api-app-keys/) reference. If you don't limit scopes, the application key inherits all of the creating user's permissions.
 </Step>
 <Step>
 Select **Create Application Key** and copy the key.
 </Step>
 </Steps>
 
 Application keys are tied to the user who creates them. They inherit that user's permissions and are revoked if the user is deactivated. For a durable setup, create the application key from a dedicated service-account user — a Datadog user object not tied to a specific person that won't be deactivated when employees leave. Create the service account in Datadog first, then repeat these steps while signed in as that account.
 
 For more detail on both key types, see Datadog's [API and application keys](https://docs.datadoghq.com/account_management/api-app-keys/) reference.
 
 ## How Datadog credentials are shared
 
 The Datadog MCP server uses a single shared credential. The API key and application key you provide are used for every user's tool calls, so Datadog sees all activity as one identity — the user or service account that owns the application key. C1 still attributes each call to the individual user who made it in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage).
 
 To keep that shared identity attributable to C1 rather than a person, create the application key from a dedicated service-account user, as described in [Create a Datadog application key](#create-a-datadog-application-key).
 
 For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication).
 
 ## Register the Datadog MCP server in C1
 
 With both keys ready, register the server and provide your credentials.
 
@@ -111,33 +111,33 @@
 Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Datadog** from the catalog.
 </Step>
 <Step>
 When you [configure authentication](/product/admin/mcp-servers#configure-authentication), provide the credentials Datadog needs:
 
 - Your Datadog **site** from [Find your Datadog site](#find-your-datadog-site)
 - Your **API key**
 - Your **application key**
 </Step>
 <Step>
 Save your changes. C1 starts a sync that discovers the tools the Datadog server exposes.
 </Step>
 </Steps>
 
 ## Discover and govern tools
 
 After you register the server, C1 runs tool discovery against Datadog. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification) for details.
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification) for details.
 
 Before anyone can call a Datadog tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to complete this setup.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Datadog credentials when an approved user successfully calls a Datadog tool from their AI client.
 </Note>
 
 ## Manage your Datadog credentials
 
 You can rotate either key or adjust the application key's scopes at any time without re-registering the server.
 
 - **Rotate the API key** in **Organization Settings** > **API Keys** in Datadog, then update the credential on the server's authentication settings in C1.
 - **Rotate the application key** the same way under **Application Keys**. If you used a service-account user, keep that account active so the key stays valid.
 - **Adjust scopes** at any time by editing the application key's authorization scopes in Datadog.

product/admin/mcp-server/freshdesk.mdx

@@ -1,58 +1,58 @@
 ---
 title: Set up the Freshdesk MCP server
 description: Create Freshdesk basic auth credentials and register the Freshdesk MCP server in C1 so AI clients can call governed Freshdesk tools.
 og:title: Set up the Freshdesk MCP server
 og:description: Create Freshdesk basic auth credentials and register the Freshdesk MCP server in C1 so AI clients can call governed Freshdesk tools.
 sidebarTitle: Freshdesk
 ---
 
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Freshdesk MCP server lets you govern access to Freshdesk — tickets, contacts, companies, and other support data — as tools your AI clients can call through C1.
 
 Freshdesk authenticates with basic auth, using a Freshdesk API key as the username. A single credential authenticates everyone, so all tool calls reach Freshdesk as one shared identity. Create the API key from a dedicated service-account agent so activity is attributable to C1 rather than a person.
 
 ## How C1 connects to Freshdesk
 
 C1 hosts the Freshdesk MCP server, so your users' AI clients only ever see MCP tools — they never call Freshdesk directly. When an AI client calls one of these tools, C1 makes the matching request to the Freshdesk API using the credentials you configure here, then returns the result to the AI client.
 
 The credentials you set up below are what C1 uses to call Freshdesk on your users' behalf.
 
 ## Before you begin
 
 - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
 - A Freshdesk agent account with the API access and role needed for the tools you plan to govern.
 
 <Note>
 If you don't see **Freshdesk** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
 </Note>
 
 ## Find your Freshdesk API key
 
 Copy the API key from your Freshdesk agent profile so C1 can authenticate as that agent.
 
 <Steps>
 <Step>
 Sign in to Freshdesk as the agent whose access the credential should carry.
 </Step>
 <Step>
 Open your profile settings and locate **Your API key**, then copy it. Treat the key like a password. See Freshdesk's [How To Find Your API Key](https://support.freshdesk.com/support/solutions/articles/215517-how-to-find-your-api-key) docs for the exact steps.
 </Step>
 </Steps>
 
 Freshdesk basic auth uses your API key as the username. Freshdesk ignores the password when an API key is used, so enter any placeholder such as `X` — it just can't be empty. For more information, see Freshdesk's [API authentication](https://developers.freshdesk.com/api/#authentication) documentation.
 
 ## How Freshdesk credentials are shared
 
 Every user's tool calls use the one API key you provided, so Freshdesk sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared production setup, create the API key from a dedicated service-account agent so activity is attributable to C1 rather than a person.
 
 For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication).
 
 ## Register the Freshdesk MCP server in C1
 
 With your API key ready, register the server and provide your credentials.
 
@@ -61,26 +61,26 @@
 Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Freshdesk** from the catalog.
 </Step>
 <Step>
 When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Basic auth**, enter your Freshdesk API key as the username, and enter any placeholder such as `X` as the password.
 </Step>
 <Step>
 Save your changes. C1 starts a sync that discovers the tools the Freshdesk server exposes.
 </Step>
 </Steps>
 
 ## Discover and govern tools
 
 After you register the server, C1 runs tool discovery against Freshdesk. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Freshdesk tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Freshdesk credentials when an approved user successfully calls a Freshdesk tool from their AI client.
 </Note>
 
 ## Manage your Freshdesk credentials
 
 - **Rotate the API key** by resetting it in Freshdesk, then update the username on the server's authentication settings in C1.
 - **Adjust access** by changing the role of the agent whose API key you use.

product/admin/mcp-server/github.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The GitHub MCP server lets you govern access to GitHub — repositories, pull requests, issues, Actions, and organization data — as tools your AI clients can call through C1.
@@ -43,7 +43,7 @@
 
 ### Create a GitHub OAuth app
 
 Register an OAuth app in GitHub so C1 can prompt each user to authorize with their own account. For the full walkthrough, see GitHub's [latest guide to creating an OAuth app](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app).
 
 <Steps>
 <Step>
@@ -86,7 +86,7 @@
 
 ### Create a personal access token
 
 Generate a fine-grained personal access token in GitHub for C1 to authenticate with. For the full walkthrough, see GitHub's [guide to managing personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens).
 
 <Steps>
 <Step>
@@ -134,9 +134,9 @@
 
 After you register the server, C1 runs tool discovery against GitHub. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a GitHub tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your GitHub credentials when an approved user successfully calls a GitHub tool from their AI client.

product/admin/mcp-server/gong.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Gong MCP server lets you govern access to Gong — calls, transcripts, users, scorecards, deals, sequences, and permission profiles — as tools your AI clients can call through C1.
@@ -33,7 +33,7 @@
 
 ## Generate Gong API credentials
 
 Generate an Access Key and Access Key Secret in Gong so C1 can authenticate to the Gong API. For Gong's own walkthrough, see [Receive access to the API](https://help.gong.io/docs/receive-access-to-the-api).
 
 <Steps>
 <Step>
@@ -84,9 +84,9 @@
 
 After you register the server, C1 runs tool discovery against Gong. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Gong tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Gong credentials when an approved user successfully calls a Gong tool from their AI client.

product/admin/mcp-server/google-analytics-admin.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Google Analytics Admin MCP server lets you govern access to Google Analytics 4 configuration — accounts, properties, data streams, custom dimensions, conversions, and account-level user permissions — as tools your AI clients can call through C1.
@@ -137,9 +137,9 @@
 
 After you register the server, C1 runs tool discovery against Google Analytics Admin. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Google Analytics Admin tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Google Analytics Admin credentials when an approved user successfully calls a Google Analytics Admin tool from their AI client.

product/admin/mcp-server/google-analytics.mdx

@@ -9,10 +9,10 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Google Analytics MCP server lets you govern access to Google Analytics 4 report data — dimensions, metrics, realtime events, pivot reports, and audience exports — as tools your AI clients can call through C1.
 
 Google Analytics supports two ways to authenticate, and you choose one when you register the server:
 
@@ -133,9 +133,9 @@
 
 After you register the server, C1 runs tool discovery against Google Analytics. Discovered tools appear on the server's **Tools** tab.
 
-Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **Settings** > **AI Connections**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Google Analytics tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Google Analytics credentials when an approved user successfully calls a Google Analytics tool from their AI client.