When AI can see into your CRM, it has to know who is asking.
Connecting AI to your CRM takes days today. The harder question is: with what rights does AI go in, and can you trace afterwards what it did? We walk through five ways to connect it, from the simplest to the most secure.
Access to data is not a technical detail. It is a decision about keys.
When a new colleague joins, you don't just ask whether they can get into the CRM. You ask what they will see, what they may change and whether you can trace who did what. The same applies to an AI agent.
An agent is a program that does tasks for you on its own: finds a client, creates a deal, sends documents. To do that, it needs access to your tools. There are several ways, and they differ mainly in one thing: how much the system knows about who is asking.
Level 5: The agent has its own key to everything.
The simplest connection. The agent logs into the tool with its own access and works.
With a person
The master key to the whole building hangs at the front desk. Whoever takes it opens everything. The building doesn't know who is holding it.
With AI
The agent enters the CRM under one shared account. The CRM doesn't know whether a salesperson, an assistant or an intern is asking, or what each of them may see.
That is why companies in their first AI projects only exposed data anyone in the company could see. For an internal chatbot over public documents, that is enough. For a CRM with margins and contacts, it is not.
Level 4: The agent borrows your badge.
The second step adds user login. The agent logs into the tool on your behalf and the tool issues it an access key. Many common tools work this way today, for example when you allow an assistant on your computer to access your calendar.
With a person
A colleague borrows your badge. The doors let them in because they think it's you.
With AI
The CRM sees you, not the agent. It doesn't know a program acted, or what exactly it was allowed to do.
There is a second weakness. Such keys often stay valid for a long time. With some tools, access can last up to 90 days. The longer a key is valid, the longer whoever finds it can misuse it.
Level 3: A single reception desk sits between the agent and your systems.
This is where MCP (Model Context Protocol) comes in. It is a common language through which AI connects to different systems. Each system gets its own MCP server, a translator that knows how to talk to it.
With a person
A new colleague doesn't need to know every department. They go to reception and get directed.
With AI
The agent doesn't need to know the details of the CRM, accounting or email. It only knows MCP. The MCP servers take care of the rest.
For the company, this means fewer fragile connections. When one system changes, you fix one translator, not every agent. That is exactly the pain we hear most often: connections that break with every update. But MCP alone doesn't solve who is asking. Levels 2 and 1, combined with MCP, do.
Level 2: The agent acts under a power of attorney.
The next step turns impersonating the user into representing them. The agent must identify itself and also carry information about on whose behalf it acts.
With a person
A colleague doesn't go to the registry office with your ID card. They go with a power of attorney. The office knows who came and whom they represent.
With AI
The system sees both: the user and the agent. It knows what each may do, and every step can be traced.
The user is no longer invisible and the agent no longer pretends to be them. Management gets what it takes for granted with people: an overview of who did what and with what authorization.
Level 1: Keys are kept in a safe and issued for one trip only.
The highest level adds a safe. Long-term credentials are locked in it, and the agent only gets a short-lived key for a specific task.
With a person
A key cabinet issues the warehouse key for an hour. After that it stops working, even if someone finds it on the floor.
With AI
If someone intercepts short-lived access, it is worthless a moment later. Long-term keys never leave the safe.
Which level you need
Not every company needs level 1 right away. What decides is how sensitive the data is and what the agent may change.
| LEVEL | HOW IT WORKS | WHAT THE SYSTEM KNOWS | WHEN IT IS ENOUGH |
|---|---|---|---|
| 5 | Agent has its own access | Doesn't know who is asking | Public internal documents |
| 4 | Agent logs in as you | Sees you, not the agent | Personal assistant over your calendar |
| 3 | Agent via MCP | Unified access to systems | More systems, fewer fragile connections |
| 2 | Agent as a representative | Sees the user and the agent | CRM, finance, changes to data |
| 1 | Safe and short-lived keys | Everything, and access expires quickly | Sensitive data, multiple agents, audit |
“The sales team wants AI to prepare a client overview from the CRM before every call. For reading, a lower level is enough. When AI is also supposed to create deals and change prices, representation and a record of every step pay off.”
Ask yourself
Do you know which account AI tools in your company use today to connect to your data?
