The app shows only what your credential is allowed to do. Two things control that: the read/write scope you pick, and the permissions on the credential itself.
Read vs read/write
For most providers you choose a scope when connecting:
- Read — dashboard only.
- Read & Write — can make changes.
This controls which actions the app offers. To switch, re-add the credential in Settings → Connections with the other scope.
Hyperscalers set permissions on the key
Amazon Web Services, Google Cloud and Azure have no read/write toggle in the app. Instead you grant permissions to the key, service account or service principal in the provider's own IAM — a read-only key simply can't perform writes. Read-only is a fine way to start.
"A section says I don't have permission"
The app discovers what a credential can do by trying. A section greys out with No permission when the provider answered "denied" — not because the app decided you can't use it. Grant the matching read permission to the credential in your provider's IAM and reopen the section; nothing needs reinstalling.
"Google Cloud says an API is not enabled"
This is different from a permission problem: the service exists but is switched off for that project. The error carries a link straight to the page that enables it — tap Open Google Cloud console, enable the API, then come back and pull to refresh.