A natural question once you've set up the new API Access for Zoho MCP permission is whether that permission is the whole story, or whether a user's existing CRM access still applies underneath it. It's confirmed to be the latter.
MCP connections operate within the access permissions of the user making the request. The user's existing CRM permissions, including roles, profiles, and field-level permissions, are applied on top of whatever the MCP connection is otherwise allowed to do.
API Access for Zoho MCP, with its Get Data and Execute Actions controls, decides whether MCP can be used at all, and whether it can only read or also write. It doesn't grant the connection any access beyond what the user already has. So an MCP connection made by a user still can't see records their role or profile excludes them from, still can't view or edit a field they don't have permission for, and still can't perform an action their profile doesn't permit, even with Execute Actions switched on for the MCP permission itself.
This is reassuring from a security standpoint, since enabling MCP for a user can't accidentally expose data or actions their profile was never meant to allow. It also means the two controls need to be considered together when scoping access properly: enabling Execute Actions for a user with an otherwise broad profile still gives that user's MCP connection broad access, so review the underlying role and profile, not just the new MCP permission, when deciding who should have it.