Understanding AI tool permissions.

Goal

Read the permissions an AI connector or agent asks for, and decide what to allow, deny or put behind a human confirmation.

Who it is for

Owners, office managers and Microsoft 365 or Google Workspace admins in New Zealand businesses connecting AI to email, files, CRMs or accounting.

Time

30 minutes.

You need

ChatGPT, Claude, Copilot or Gemini and the fictional permission request below.

You will produce

A permission matrix for one assistant, with a decision and reason for every access request.

What does a permission actually allow?

A permission lets the AI do something with your access. When you connect an assistant to a mailbox or drive, it usually signs in as you, so it can reach what you can reach. Anthropic’s connector guidance says connecting a service grants Claude “the ability to access and potentially modify data within those services based on your permissions.”

Microsoft describes the same principle: Copilot works with “emails, chats, and documents that you have permission to access.” That is reassuring and revealing at once. If your SharePoint sharing is loose, Copilot will surface overshared files quickly.

Which questions should you ask of every connection?

Ask four questions before you click Allow:

1. What can it read? The whole mailbox, or one shared inbox? Every file, or one folder?
2. What can it change? Can it create drafts, edit records, move files or delete?
3. Whose identity does it use? Your account, a shared credential, or a dedicated service account with its own limited access?
4. When does a person confirm? Before every write, only before sending, or never?

How risky is each kind of access?

The OWASP Top 10 for LLM Applications 2026 names the underlying problem Excessive Agency, with three root causes: “excessive functionality, excessive permissions, excessive autonomy.” Each row above trims one of them.

Exercise: build a permission matrix

The firm, task and permission requests below are fictional and simplified.

Illustrative permission request. Fictional plumbing firm, Napier.

Task for the assistant: read new job enquiries in the shared
jobs@ inbox, look up the customer in the CRM, and draft a quote
in the job folder from our template. The office manager checks
and sends every quote.

Permissions requested when connecting:
Email (Microsoft 365)
  E1 Read all mail you can access
  E2 Create and edit drafts
  E3 Send mail as you
Files (SharePoint)
  F1 Read all files you can access
  F2 Read and write all files you can access
CRM
  C1 Read contacts and deals
  C2 Create and update notes
  C3 Delete contacts
Accounting (Xero)
  X1 Read and write invoices, bills and contacts

1. Run the matrix prompt in the worked example below with the request above.
2. Check each decision against the task. Anything the task does not mention should be denied, however convenient.
3. Narrow what remains. Where a scope is too broad, write what you would rather allow, such as “read the jobs@ inbox only” or “write to the AI drafts folder only”.
4. Mark confirmation points. Every write that remains needs a named person to approve it.
5. Check the risky combination. Does the assistant read outside content, see private data and have a way to send? If so, remove one leg. See recognising prompt injection.
6. Record the result with the connection’s owner and a review date three months out.

Worked example: the permission matrix prompt

Act as a cautious IT administrator. For the task and permission
requests below, produce a table with columns:
ID | System | Access type (read/draft/write/send/delete) |
Needed for the task? | Decision (deny / allow / allow with
confirmation / narrow) | Reason

Rules: least privilege. Deny anything the task does not need.
Prefer narrower alternatives. Flag any combination that lets the
assistant read outside content, see private data and send
externally.

[paste task and permission requests]

Example output (illustrative and abridged; your tool’s wording will differ):

E1 | Email | read | Partly | Narrow | Needs jobs@ only, not all mail
E2 | Email | draft | Yes | Allow | Office manager reviews drafts
E3 | Email | send | No | Deny | Office manager sends quotes
F2 | Files | write | Partly | Narrow | Write to one AI drafts folder
C3 | CRM | delete | No | Deny | Never needed for quoting
X1 | Xero | write | No | Deny | Task does not touch accounting

Flag: E1 + F1 + E3 together would let instructions in an outside
email reach private files and leave by email. Denying E3 removes
the send leg.

Where this goes wrong

• Write access without confirmation. Xero’s remote MCP FAQ says its V1 tools “do not elicit user confirmation” and advises asking your agent to confirm before writing back to Xero. Assume other tools behave the same until you check. Our Xero integration guide covers the options.
• “Allow always” clicked once. Anthropic advises using it only for servers and tools you trust to run unsupervised.
• Shared credentials. On Claude Team and Enterprise, a connector set up with a fixed key gives every user the same access, so limit that key.
• Apps on by default. OpenAI’s admin controls page says apps are enabled by default in ChatGPT Business; admins should decide which stay on.
• Permissions set once, never reviewed. The NCSC’s agentic AI guidance describes an agent granted broad access to “reduce friction”, with permissions evaluated only at deployment, that let an attacker approve payments.

Check your work

• I can name the four questions to ask before connecting an AI tool.
• My matrix denies every permission the task does not need.
• Every remaining write or send has a named person who confirms it.
• I checked for the read, private data and send combination and removed a leg.
• Each connection has an owner and a review date.
• I know how to revoke a connection in the AI tool and in the connected service.

Where to go next

Next in the pathway: building a no-code AI prototype, where you can apply this matrix to your own assistant. For the ideas behind connected assistants, see understanding AI agents, and test any agent against the AI agent acceptance checklist. Engineers should read agent permissions and approvals and MCP for business systems. Before connecting AI to finance or client systems, an AI security review checks the matrix against how the systems really behave.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.