---
title: "How Assistant Access Works"
description: "Every tenant has one endpoint; the subaccount's own XSUAA signs the person in; roles and add-ons apply unchanged; the assistant confirms before it writes."
source: "https://help.rikaiso.com/public-cloud/2026.2/how-mcp-access-works"
edition: "public-cloud"
editionLabel: "S/4HANA Public Cloud"
version: "2026.2"
latest: true
language: "en"
section: "Information for Administrators > AI Assistants and Integrations: Enabling Access"
updated: "2026-11-05"
---

# How Assistant Access Works

> Every tenant has one endpoint; the subaccount's own XSUAA signs the person in; roles and add-ons apply unchanged; the assistant confirms before it writes.

> **Draft brief for authors.** Replace with the final text; keep the concept-page structure.

**Page type:** Concept · **Audience:** Administrator

**Contains:** the endpoint per tenant (`https://YOUR-MDM-HOST/mcp/mdm/t/YOUR-SUBDOMAIN`); sign-in through your subaccount's XSUAA (a client that registers itself is sent to your login by MDM's relay); the person's roles and add-ons apply; confirmations before processing and deleting; the language of answers; what is logged (every action in Application Logs under the person).

**Related information:** `service-broker-credentials`, `ai-client-setup-matrix`, `what-assistants-can-do`.

**Source in the product repository:** customer guide §6, `docs/joule-integration.md` "Other MCP clients" (D92).