Subaccounts with Self-Serve OAuth and Admin-Controlled Source/Destination Permissions#1927

Problem
Today, Windsor.ai access is centered on a single account and API key per organization. For agencies managing many clients, this means one central team has to handle every OAuth connection and API key distribution themselves. There is no way to let individual client teams, business units, or sub-clients connect their own data sources while still keeping everything under central oversight. Especially for leveraging the Windsor MCP, this would be great to manage, but acces on a user level.

Proposed Solution
Subaccounts under a master account. Let an agency or enterprise create a master account with subaccounts underneath it. Give each subaccount owner the ability to do their own OAuth flow to connect their sources (ad platforms, CRMs, analytics, etc.), rather than routing every connection through the central admin.

Admin-controlled permissions on sources and destinations: Let the master account admin define, per subaccount, which source types and destination types are allowed to be connected at all. This keeps governance centralized even though connection work is distributed.

Windsor as pipeline infrastructure, MCP as the access layer. Once sources are connected at the subaccount level, Windsor handles the pipeline (auth refresh, data normalization, delivery), and MCP access is scoped to that subaccount automatically, so a subaccount’s MCP connection only ever sees its own connected sources and destinations.

Why This Matters
This turns Windsor.ai into real self-serve infrastructure for agencies: the central data team sets the guardrails once (allowed sources and destinations), then delegates the actual connecting work to the people who own each client relationship. It removes the central team as a bottleneck, keeps a clean permission boundary between clients, and makes MCP a safe, scoped tool that individual client teams can use directly rather than something only the data team can touch.