# When AI can see into your CRM, it has to know who is asking.

Jaro Rais · 6 min read · 2026-10-30 · Integrations and MCP
Source: https://itashu.co/en/know-how/ai-in-your-crm-must-know-who-is-asking

Connecting AI to your CRM takes days today. The harder question is: with what rights does AI go in, and can you trace afterwards what it did? We walk through five ways to connect it, from the simplest to the most secure.

![Stairs with five levels of access: a key on a hook, a borrowed badge, a reception desk, a stamped power of attorney and a vault with a clock at the top](https://itashu.co/img/art-14-hero-1280.webp)

## Access to data is not a technical detail. It is a decision about keys.

When a new colleague joins, you don't just ask whether they can get into the CRM. You ask what they will see, what they may change and whether you can trace who did what. **The same applies to an AI agent.**

An agent is a program that does tasks for you on its own: finds a client, creates a deal, sends documents. To do that, it needs access to your tools. There are several ways, and they differ mainly in one thing: **how much the system knows about who is asking.**

## 05 Level 5: The agent has its own key to everything.

The simplest connection. The agent logs into the tool with its own access and works.

- **With a person:** The master key to the whole building hangs at the front desk. Whoever takes it opens everything. The building doesn't know who is holding it.
- **With AI:** The agent enters the CRM under one shared account. The CRM doesn't know whether a salesperson, an assistant or an intern is asking, or what each of them may see.

That is why companies in their first AI projects only exposed data anyone in the company could see. For an internal chatbot over public documents, that is enough. **For a CRM with margins and contacts, it is not.**

![A CRM, a spreadsheet and email connected through one shared MCP node](https://itashu.co/img/art-14-mcp-1280.webp)

## 04 Level 4: The agent borrows your badge.

The second step adds user login. The agent logs into the tool on your behalf and the tool issues it an access key. Many common tools work this way today, for example when you allow an assistant on your computer to access your calendar.

- **With a person:** A colleague borrows your badge. The doors let them in because they think it's you.
- **With AI:** The CRM sees you, not the agent. It doesn't know a program acted, or what exactly it was allowed to do.

There is a second weakness. Such keys often stay valid for a long time. With some tools, access can last up to 90 days. **The longer a key is valid, the longer whoever finds it can misuse it.**

## 03 Level 3: A single reception desk sits between the agent and your systems.

This is where [MCP (Model Context Protocol)](https://itashu.co/en/know-how/skills-mcp-rag-and-memory#kapitola-02) comes in. It is a common language through which AI connects to different systems. Each system gets its own MCP server, a translator that knows how to talk to it.

- **With a person:** A new colleague doesn't need to know every department. They go to reception and get directed.
- **With AI:** The agent doesn't need to know the details of the CRM, accounting or email. It only knows MCP. The MCP servers take care of the rest.

For the company, this means fewer fragile connections. **When one system changes, you fix one translator, not every agent.** That is exactly the pain we hear most often: connections that break with every update. But MCP alone doesn't solve who is asking. Levels 2 and 1, combined with MCP, do.

## 02 Level 2: The agent acts under a power of attorney.

The next step turns impersonating the user into representing them. The agent must identify itself and also carry information about on whose behalf it acts.

- **With a person:** A colleague doesn't go to the registry office with your ID card. They go with a power of attorney. The office knows who came and whom they represent.
- **With AI:** The system sees both: the user and the agent. It knows what each may do, and every step can be traced.

**The user is no longer invisible and the agent no longer pretends to be them.** Management gets what it takes for granted with people: an overview of who did what and with what authorization.

## 01 Level 1: Keys are kept in a safe and issued for one trip only.

The highest level adds a safe. Long-term credentials are locked in it, and the agent only gets a short-lived key for a specific task.

- **With a person:** A key cabinet issues the warehouse key for an hour. After that it stops working, even if someone finds it on the floor.
- **With AI:** If someone intercepts short-lived access, it is worthless a moment later. Long-term keys never leave the safe.

## Which level you need

Not every company needs level 1 right away. **What decides is how sensitive the data is and what the agent may change.**

| LEVEL | HOW IT WORKS | WHAT THE SYSTEM KNOWS | WHEN IT IS ENOUGH |
| --- | --- | --- | --- |
| 5 | Agent has its own access | Doesn't know who is asking | Public internal documents |
| 4 | Agent logs in as you | Sees you, not the agent | Personal assistant over your calendar |
| 3 | Agent via MCP | Unified access to systems | More systems, fewer fragile connections |
| 2 | Agent as a representative | Sees the user and the agent | CRM, finance, changes to data |
| 1 | Safe and short-lived keys | Everything, and access expires quickly | Sensitive data, multiple agents, audit |

> **In practice:** “The sales team wants AI to prepare a client overview from the CRM before every call. For reading, a lower level is enough. When AI is also supposed to create deals and change prices, representation and a record of every step pay off.”

**Ask yourself:** Do you know which account AI tools in your company use today to connect to your data?

---

Tell us which systems you want to connect. We'll show you what access they need and where to start. https://itashu.co/en/consultation