sadpandajoe commented on code in PR #43900:
URL: https://github.com/apache/superset/pull/43900#discussion_r4151107268
##########
docs/developer_docs/extensions/mcp.md:
##########
@@ -462,6 +462,76 @@ async def metrics_guide(ctx: Context) -> str:
"""
```
+## Built-in Dashboard Governance Tools
+
+Superset ships three built-in MCP tools for dashboard governance:
+`manage_dashboard_owners`, `manage_dashboard_roles`, and
+`manage_dashboard_certification`. They exist alongside the generic
+`update_dashboard` tool because a few governance fields are unsafe to expose
+as full-replacement lists to an LLM caller — each tool instead takes
+explicit, narrow operations with its own safety semantics.
+
+### `manage_dashboard_owners`
+
+Adds or removes dashboard owners (the USER-type entries in the dashboard's
+Subject-based `editors` list) via `add_owner_ids`/`remove_owner_ids`, never
+a full-replacement list. This guards against the "empty owners" footgun:
+`update_dashboard` intentionally dropped its `owners` field because a
+full-replacement list has no way to prevent an admin from emptying it
+outright.
+
+- **Owner-removal guard**: a request that would leave the dashboard with
+ zero owners is rejected. To transfer ownership, add the new owner in the
+ same call as removing the last existing one.
+- **Self-removal protection**: a non-admin caller who removes themselves is
+ automatically re-added, mirroring the lockout protection
+ `update_dashboard` already relies on (unless an `EXTRA_EDITORS_RESOLVER`
+ is configured). The response's `warnings` reports when this happens.
+- ROLE- or GROUP-type editors already on the dashboard are left untouched.
+- A no-op request (e.g. "adding" an ID that's already an owner) returns an
+ empty `owners` list rather than the full current set, so the tool can't
+ be used as a disguised directory lookup.
Review Comment:
An editor can still retrieve the full current owner or role ID list without
changing anything by requesting removal of an unassigned ID: both tools include
the current list in that error response. Should this avoid promising that the
tools cannot be used as directory lookups unless those error paths also
withhold the lists?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
