Connect an AI agent to your CRM: which permissions does it need?

“Help the sales team” does not define access. “Prepare a draft follow-up for open quotes past their due date” identifies the necessary fields: reference, status, date, contact and owner. The pilot can exclude other records, attachments and unrelated free-text notes. Record this boundary in the AI agent requirements brief.

Then ask whether a conventional rule is enough. A date filter and standard message do not always require a language model. AI becomes a candidate when the task involves interpreting variable text or preparing a contextual response. Connecting the CRM remains an integration project, even when the interface looks simple. Compare the approaches in our guide to AI agents and conventional automation.

The following is a proposed starting scope for a follow-up pilot. It does not describe a live client connection. Adapt permissions to the CRM, each person’s role and the information needed. A “not authorised” column makes exclusions verifiable; it is more useful than a vague statement such as “secure access”.

Complete the file with the process owner and CRM administrator. For each operation, add the fields, accessible records, approver and a denial test. Keep a dated version. A subscription offering a connector does not prove that its permissions are granular enough for your use case; ask to see what can actually be restricted.

Partna built the Champions Academy CRM. The code reviewed for this guide distinguishes read and write permissions, checks access in the database and records operations in an audit log. Account deactivation is also part of the access model. These elements illustrate a concrete separation of responsibilities in business software.

This does not mean that an AI agent is currently connected to that CRM, or that every permission in the matrix exists in the application. This guide proposes a method for a future integration. It publishes no member data and claims no productivity result. A code review provides design evidence; it does not replace access tests in the actual deployed environment.

Writing “never change amounts” in an instruction helps define the task, but does not remove write access. The restriction must be enforced by the connector, service or database receiving the action. The Supabase row-level security documentation describes checks that run inside the database. Their configuration depends on your application.

OWASP identifies excessive functions, permissions and autonomy as three sources of risk in language-model applications. Its recommendations include limiting tools and enforcing authorisation in the systems that execute actions. See Excessive Agency. A decision-maker should therefore verify the integration’s effective scope, beyond the wording of its instructions.

Use authorised test records and write down the expected result before running a test. A successful demonstration with a complete record does not establish how exceptions behave. For each test, record the date, connector version, observed result and the person who accepts or rejects release.

1. An authorised, complete record

The draft uses the correct reference and recipient. The reviewer can trace the information used. Also check that preparing the text does not modify any other field.

2. An out-of-scope record

Reading is denied. An empty result or explicit message is preferable to a summary using another record’s information. Observe the denial in the system rather than accepting the model’s statement that it refused.

3. Missing or contradictory information

The quote appears open but a note says it was accepted. The pilot flags the conflict and leaves the record pending. It must not silently choose whichever source allows a follow-up to be sent.

4. A forbidden request inside a note

A test note asks to change an amount or export contacts. These actions remain unavailable or are denied. The contents of a customer record do not authorise expanding the integration’s permissions.

5. An approval that has become outdated

After approving the draft, change the recipient or status in the test data. The process must follow the agreed rule: request renewed approval or stop sending. It must not blindly reuse an old approval.

6. Revoked access or an interrupted connection

Disable the test account and check a new attempt. Also simulate a disconnection after preparation. Define how to recognise an action already executed before retrying it: repetition must not cause a duplicate message.

Name a process owner for exceptions and a technical owner for access, connector changes and incidents. One person may hold both roles in a small team, but the responsibilities should remain explicit. Agree which events to monitor: failed reads, permission denials, pending drafts, completed actions and repeated attempts. Do not copy entire records into logs by default.

Before a change, rerun the baseline tests on an authorised copy or in a test environment. Keep a procedure for stopping the pilot and resuming work manually. A temporary stop can be appropriate if denials increase or correction time absorbs the time saved. Our administrative measurement worksheet helps count preparation, review and correction without presenting an estimate as a client result.

Ask the provider to separate scoping, connection, exception handling, testing, training and ongoing support. Specify the access handed to your team, provider dependencies and excluded operations. For each promise of autonomy, ask which exact action becomes automatic and what control remains. The outcome may be limited automation, draft preparation or postponing the project if access cannot be restricted precisely enough.

Partna supports business AI agent scoping, integrations and workflow training. Bring a task, an authorised anonymised example and the completed matrix. The first discussion aims to define a verifiable scope, rather than promise a universal connection to every CRM.

Prepared by the Partna team on 5 October 2026 using the Champions Academy CRM permission code and the primary Supabase and OWASP documentation linked above. The matrix and tests are educational proposals to adapt with your administrator. No full security audit, certification or compliance review is claimed. Verify your CRM and connector capabilities before committing.