(disclosure: some iterations were done using Claude Code)
Every integration that talks to the hub through an app endpoint should be able to get exactly the access it needs, and no more. The hub already has half of this: each app instance has its own token, and an app is only handed the devices selected in its settings. Maker API, Dashboard, HomeKit Bridge and the Echo Skill all rely on that.
Past the device list, every app is on its own. Dashboard has a read-only option, Maker API does not. Maker API has toggles for modes, HSM and hub variables; Dashboard gates the first two behind a PIN; each app does it its own way. LAN-only vs cloud is a check in app code; an app that skips it answers on cloud.hubitat.com by default, with a token that never expires. The platform keeps no record of which integration issued a command; Maker API can log its own calls, nothing else can.
The AI (MCP) Connector shows what that costs. It is one token for the whole hub. Every device is controllable, and the only brake on sensitive commands is a flag the client sets on its own call. A read-only token for a diagnostic tool, or a lights-and-thermostats token for an assistant that must never touch locks, cannot be set up.
The need
For any integration, per instance, the hub admin (a person) should be able to decide what the client can access with an app token:
- which devices it can see
- whether it can read only, control, or also configure
- whether it can touch modes, HSM, hub variables, and rules or actions
- whether the token works from the LAN, the cloud, or both
- whether it may issue sensitive commands such as unlock, disarm, or a mode change
- and afterwards, see what it did
These decisions belong to the platform, enforced before a request reaches the app, so that every integration gets them consistently and a community app cannot forget one. The device list comes closest today: the platform hands an app only the devices selected for it.
This bounds what a client can do through an integration. What an installed app itself can do on the hub is a separate topic and not part of this request.
Two possible directions, offered as suggestions only: a way for a client to read its own grant, so an AI knows what it may do before it tries; and an opt-in for community apps so existing ones keep working.
Other platforms have converged on this shape. Home Assistant exposes entities per assistant and has a control switch on its MCP server. SmartThings scopes each app token by device and by read, write, or execute. Matter puts a small access control list on every device.
On my own hubs, every integration that offers a device list is scoped narrowly: 15 Maker API instances with at most 5 devices each, dashboards at 2 to 23. The MCP servers are the only ones with hub-wide reach.
One last point. Agentic AI clients act on their own between user prompts, and they sometimes do things the user did not ask for. Prompt instructions and client-side flags are not a safeguard against that. The hub is the only place where a limit holds, and this model is how it would hold.
See also posts in this topic