diff --git a/docs/profiles.md b/docs/profiles.md
index d36ad0e..6ed3d69 100644
--- a/docs/profiles.md
+++ b/docs/profiles.md
@@ -183,9 +183,12 @@
 risk below; the boundary instruction in the three system prompts ("pass only session paths
 and the paths the 3D server returned") is a prompt rule, not a code check.
 
-MCP groups are all read-only or local:
+MCP groups are local, read-only, or the user's own tracking server:
 
-- `assistant` — `navi-web` (`search`, `browse`), `navi_ui` (`ui`), and read-only use of the owner's knowledge and tracking servers: `gnexus-book` (`read`), `gntodo` (`read`), `synapse` (`read`), `hard-panel` (`read`).
+- `assistant` — `navi-web` (`search`, `browse`), `navi_ui` (`ui`), and the knowledge and
+  tracking servers their own key unlocks: `gnexus-book` (`read`), `gntodo` (`read`, `write`).
+  The owner's monitoring surfaces (`synapse`, `hard-panel`) are not given to it at all, not
+  even read-only.
 - `designer_3d` — `navi-3d` (`modeling`, `analysis`), `navi-web` (`search`, `browse`), `navi_ui` (`ui`).
 - `coder` — `navi-web` (`search`, `browse`), `gnexus-book` (`read`), `gntodo` (`read`).
 
@@ -195,8 +198,10 @@
 
 Because MCP servers with a `user_key` slot require the user's own credential, those groups
 only take effect once the user has saved a key in **Settings → MCP keys**; without one the
-server is not offered to them at all. `navi-3d`, `navi-web` and `navi_ui` have no slot and
-are always available.
+server is not offered to them at all — and the run is told why: the `[MCP servers]` block in
+the system prompt names the withheld server and says the key is missing, so the assistant
+explains it instead of silently lacking the tools. `navi-3d`, `navi-web` and `navi_ui` have
+no slot and are always available.
 
 Two consequences worth knowing:
 
diff --git a/navi/profiles/assistant/config.json b/navi/profiles/assistant/config.json
index 3bc06c7..3c70a87 100644
--- a/navi/profiles/assistant/config.json
+++ b/navi/profiles/assistant/config.json
@@ -71,13 +71,8 @@
           "read"
         ],
         "gntodo": [
-          "read"
-        ],
-        "synapse": [
-          "read"
-        ],
-        "hard-panel": [
-          "read"
+          "read",
+          "write"
         ]
       }
     },