Connecting AI to your CRM.

Goal: Connect an AI assistant to your CRM with the least access that works, prove its answers are right, and allow one supervised change. Who it is for: Sales managers, CRM administrators and owners of small sales teams using HubSpot, Pipedrive, Salesforce or a similar CRM. Time: 45 minutes, plus CRM access, an AI tool your workspace allows to connect, and one test record you can safely change.

The first thing to understand about CRM connectors is whose hands the assistant is using. When you connect ChatGPT or Claude to your CRM, it signs in as you. If you are the CRM administrator who can export every contact and delete any deal, so can the assistant, on the strength of a sentence typed into a chat box. Nothing about that is hidden, and the vendors say so clearly. It simply means the setup decisions matter more than the prompts.

How AI connects to a CRM in 2026

Most connections now use the Model Context Protocol, an open standard for connecting AI applications to external systems. Your options, as of 19 October 2026:

Two vendor examples show what connectors now allow. HubSpot’s remote MCP server became generally available on 13 April 2026 with write access to contacts, companies, deals, tickets and activities; HubSpot says “all actions respect your existing HubSpot user permissions”, and if an account has sensitive data turned on, activity records are blocked through the connector. Pipedrive’s MCP server works with ChatGPT and Claude on all plans, limits usage by plan tokens, and records actions in the change log.

Exercise: connect read-only, verify, then allow one write

1. List your own CRM permissions. Note which pipelines and records you can see, and whether you can export, bulk edit or delete. The assistant gets exactly the same. If you are an administrator, ask whether a lower-permission user is more appropriate for AI use.
2. Check the workspace rules. In business AI plans, administrators control which connectors are allowed; OpenAI’s help page notes that ChatGPT Business admins can change app access. Ask your admin rather than connecting from a personal account.
3. Connect, or use an export. Install the CRM vendor’s own connector. If you cannot connect, export 50 de-identified deals to CSV and run the same questions on the file.
4. Ask five read questions you can check. Use the worked example below, plus questions such as open deals by stage or deals closing this month.
5. Verify every answer in the CRM. Open the records. Mark each answer right, wrong or incomplete, and note why.
6. Make one supervised write. On a test record, ask for a follow-up task. Require the assistant to show the exact change and record link first. Approve it, then find it in the CRM’s change history.
7. Write your rules. One short list: what the assistant may read, what it may write, and what it must never do, such as delete, bulk update, export or email contacts.

Worked example: stalled deals, then one task

Illustrative example: a Wellington commercial fit-out company with a five-person sales team on HubSpot. The business, deals and figures are fictional.

Using the CRM connection, list open deals in the "Negotiation" stage
with no logged activity in the last 21 days.
For each: deal name, owner, amount, last activity date and a link to
the record. Do not change anything.
If you cannot see activity data for a deal, say so instead of treating
it as "no activity".

Example output (illustrative, abridged):

Deal                         Owner   Amount (NZD)  Last activity
Harbour Quay level 3 fit-out Aroha   $186,000      12 Sept 2026
Te Aro dental clinic         Ben     $74,500       9 Sept 2026
Lambton office refresh       Aroha   $41,200       4 Sept 2026

2 further deals in Negotiation returned no activity records. I cannot
tell whether they have no activity or the activity is restricted.
Links to all five records are below.

The second paragraph is the important one. “No activity” and “activity I cannot see” look identical in a summary, and treating one as the other is how stalled-deal reports go wrong. Check those two deals yourself. Then the write:

On the test deal "TEST Fit-out (do not use)", create a task "Call to
confirm site visit" due Friday, assigned to me. Before creating it, show
me the exact record link and fields you will set, and wait for my OK.

Where CRM connections go wrong

• The wrong record. Two contacts called Sarah Taylor, or two companies with similar names. Require the record link before approving any write.
• Duplicates. When a search misses an existing contact, the assistant may create a new one. Ask it to search and confirm first.
• Overwritten fields. A “tidy up” request changes lifecycle stages or owners across many records. Keep bulk edits out of scope.
• Instructions hidden in CRM data. Logged emails and notes are text the assistant reads. NCSC’s guidance on agentic AI describes malicious prompts hidden in phishing emails to manipulate email-reading agents, and recommends least privilege. Keep writes approval-gated.
• Silent gaps. Restricted objects, sensitive-data settings and plan limits can hide data without an error. Ask the assistant to say what it could not see.
• Privacy creep. Asking the assistant to “enrich” contacts with job titles and backgrounds from the web is indirect collection, and since 1 May 2026 IPP3A can require you to tell the people concerned. Our lesson on researching a customer account covers a safer pattern.

For CRM-specific detail, see our guides to AI and HubSpot, AI and Pipedrive and AI and Salesforce. The engineering view is in MCP for business systems and agent permissions and approvals, and the wider principles are in understanding AI tool permissions. For integrations with narrower permissions than a general connector allows, our AI integration services build on the CRM’s API directly.

Self-check

• You know exactly what your CRM user can see, change, export and delete.
• The connector was approved for your workspace, not added from a personal account.
• Five read answers were checked against the CRM and the results recorded.
• The assistant reported data it could not see instead of treating it as absent.
• One write was made on a test record after you saw the exact change.
• The change appears in the CRM’s history under the expected user.
• Your rules list what the assistant must never do.

Next lesson: Understanding AI agents.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.