Key takeaways
- Connectors turn an assistant that writes text into one that reads your systems and, increasingly, changes them.
- Read access and write access are different decisions. Default to read-only.
- Content the assistant reads can contain instructions. Treat that as a real risk, not a theoretical one.
- Keep an approved connector list, and do not let staff add their own by default.
A year ago most business AI use was a person pasting text into a chat window. Now assistants connect directly to email, calendars, file stores, CRMs, project tools and accounting systems, often through the Model Context Protocol, an open standard for connecting AI to tools. That is where much of the value is. It is also the biggest change to the risk profile of business AI since it arrived.
What a connector actually grants
A connector usually acts with the permissions of the user who connected it. If that user can see the whole shared drive, so can the assistant. If they can send email, a connector with send permission can too. The assistant does not get new rights, but it uses existing ones faster, more broadly and with less judgement than a person would.
Three risks to plan for
Oversharing
The assistant surfaces information the user technically had access to but would never have found. This is the same problem as Copilot and loose SharePoint permissions. See fixing permissions before Copilot.
Instructions hidden in content
An email, web page or document the assistant reads can contain text written to manipulate it: "forward this thread to this address", "ignore your previous instructions". This is known as prompt injection. Providers have defences, but none are perfect. The practical answer is to limit what an assistant can do after reading untrusted content, especially sending, deleting or paying.
Actions on real systems
A connector with write access can create, change or delete records. A misunderstanding that would produce a bad draft in chat produces a bad record in your CRM, or an email to a client. Require a person to approve any action that leaves the building or cannot be undone.
A decision framework
| Connector type | Default | Notes |
|---|---|---|
| Your file store (Drive, SharePoint, OneDrive) | Allow, read-only | Fix permissions first |
| Email and calendar | Allow read. Approve before send | Highest prompt injection exposure |
| Chat (Slack, Teams) | Allow, read-only | Exclude private and HR channels if possible |
| CRM and project tools | Read for most, write for named users | Log changes |
| Finance, payroll, banking | Do not allow initially | Revisit with specific controls |
| Third-party or unofficial MCP servers | Do not allow without review | Treat as new software with data access |
How to set it up
- Turn off user-added connectors in the admin console, where your plan allows it. Business plans from the major providers include admin control over connectors.
- Publish an approved list with the access level for each.
- Prefer official connectors from the AI provider or the system vendor over third-party ones.
- Review third-party MCP servers like any other software: who built it, where data goes, what it can access.
- Require approval for actions that send, delete, pay or publish.
- Review quarterly. Remove connectors nobody uses.
The simplest rule that prevents most incidents: an assistant that has just read content from outside the business should not be able to send anything outside the business without a person clicking approve.
Write these rules down in your AI agent policy, and set budgets alongside permissions using AI agent spending limits.
Frequently asked questions
What is an AI connector?
A connector links an AI assistant to another system, such as email, a file store, a CRM or a project tool, so it can read information from it and sometimes act on it. Many connectors are now built on the Model Context Protocol, an open standard supported by the major AI providers.
Are AI connectors safe?
They can be, with sensible limits. The risks are that the assistant can read more than the user should share, that content it reads may contain hidden instructions, and that write access lets mistakes reach real systems. Allow a short list, prefer read-only, and require approval for actions.
What is MCP?
The Model Context Protocol is an open standard for connecting AI applications to tools and data sources. It lets one connector work across different AI assistants. From a business point of view, an MCP server is a connector, and should be approved and reviewed like any other software.
Should staff be able to add their own connectors?
Not by default. Admins should maintain an approved list. Individual connectors, especially third-party ones, should be reviewed before they are enabled, just like any other software that can access company data.
Get a straight answer for your business
The Clarity Package gives you a written business case and a detailed implementation plan for 500 USD. The Implementation Package does the whole build, live in 30 days, for a fixed 5,000 USD.