# Understanding AI tool permissions.

URL: https://levystreet.com/learn/understanding-ai-tool-permissions/
Updated: 2026-10-19

AI agent permissions explained for NZ teams: what read, write and send access allow, whose identity an AI acts as, and how to build a permission matrix.

## Short answer

AI agent permissions are the access rights you grant when you connect an AI tool to email, files or business systems: what it can read, what it can create or change, what it can send, and whose identity it uses. For New Zealand businesses the safe default is least privilege: allow only what one defined task needs, require a person to confirm anything that writes, sends or pays.

- A connected AI acts with your access, so it can reach anything you can.
- Separate read, draft, write, send and delete; they carry very different risk.
- Require human confirmation for anything that changes records or leaves the business.
- Xero's V1 remote MCP tools write data without asking for confirmation.
- Review connections regularly; permissions granted once tend to stay forever.

- **Goal**: Read the permissions an AI connector or agent asks for, and decide what to allow, deny or put behind a human confirmation.
- **Who it is for**: Owners, office managers and Microsoft 365 or Google Workspace admins in New Zealand businesses connecting AI to email, files, CRMs or accounting.
- **Time**: 30 minutes.
- **You need**: ChatGPT, Claude, Copilot or Gemini and the fictional permission request below.
- **You will produce**: A permission matrix for one assistant, with a decision and reason for every access request.


## What does a permission actually allow?

A permission lets the AI do something with your access. When you connect an assistant to a mailbox or drive, it usually signs in as you, so it can reach what you can reach. Anthropic's [connector guidance](https://support.claude.com/en/articles/11175166) says connecting a service grants Claude "the ability to access and potentially modify data within those services based on your permissions."

Microsoft describes the same principle: [Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy) works with "emails, chats, and documents that you have permission to access." That is reassuring and revealing at once. If your SharePoint sharing is loose, Copilot will surface overshared files quickly.

## Which questions should you ask of every connection?

Ask four questions before you click Allow:

1. **What can it read?** The whole mailbox, or one shared inbox? Every file, or one folder?
2. **What can it change?** Can it create drafts, edit records, move files or delete?
3. **Whose identity does it use?** Your account, a shared credential, or a dedicated service account with its own limited access?
4. **When does a person confirm?** Before every write, only before sending, or never?

## How risky is each kind of access?

| Access level | Example | Default decision |
|---|---|---|
| Read, narrow | Read one shared inbox or one folder | Allow if the task needs it |
| Read, broad | Read all mail or all files you can open | Avoid; narrow it or use a separate account |
| Draft | Create email drafts or documents for review | Allow; a person still decides |
| Write | Update CRM records, edit files, create invoices | Allow with confirmation of each change |
| Send or publish | Send email, post messages, pay | Deny, or confirm the exact action every time |
| Delete or admin | Delete records, change sharing, manage users | Deny |

The OWASP Top 10 for LLM Applications 2026 names the underlying problem [Excessive Agency](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/), with three root causes: "excessive functionality, excessive permissions, excessive autonomy." Each row above trims one of them.

## Exercise: build a permission matrix

The firm, task and permission requests below are fictional and simplified.

```text
Illustrative permission request. Fictional plumbing firm, Napier.

Task for the assistant: read new job enquiries in the shared
jobs@ inbox, look up the customer in the CRM, and draft a quote
in the job folder from our template. The office manager checks
and sends every quote.

Permissions requested when connecting:
Email (Microsoft 365)
  E1 Read all mail you can access
  E2 Create and edit drafts
  E3 Send mail as you
Files (SharePoint)
  F1 Read all files you can access
  F2 Read and write all files you can access
CRM
  C1 Read contacts and deals
  C2 Create and update notes
  C3 Delete contacts
Accounting (Xero)
  X1 Read and write invoices, bills and contacts
```


1. **Run the matrix prompt** in the worked example below with the request above.
2. **Check each decision against the task.** Anything the task does not mention should be denied, however convenient.
3. **Narrow what remains.** Where a scope is too broad, write what you would rather allow, such as "read the jobs@ inbox only" or "write to the AI drafts folder only".
4. **Mark confirmation points.** Every write that remains needs a named person to approve it.
5. **Check the risky combination.** Does the assistant read outside content, see private data and have a way to send? If so, remove one leg. See [recognising prompt injection](/learn/recognising-prompt-injection/).
6. **Record the result** with the connection's owner and a review date three months out.


## Worked example: the permission matrix prompt

```text
Act as a cautious IT administrator. For the task and permission
requests below, produce a table with columns:
ID | System | Access type (read/draft/write/send/delete) |
Needed for the task? | Decision (deny / allow / allow with
confirmation / narrow) | Reason

Rules: least privilege. Deny anything the task does not need.
Prefer narrower alternatives. Flag any combination that lets the
assistant read outside content, see private data and send
externally.

[paste task and permission requests]
```

Example output (illustrative and abridged; your tool's wording will differ):

```text
E1 | Email | read | Partly | Narrow | Needs jobs@ only, not all mail
E2 | Email | draft | Yes | Allow | Office manager reviews drafts
E3 | Email | send | No | Deny | Office manager sends quotes
F2 | Files | write | Partly | Narrow | Write to one AI drafts folder
C3 | CRM | delete | No | Deny | Never needed for quoting
X1 | Xero | write | No | Deny | Task does not touch accounting

Flag: E1 + F1 + E3 together would let instructions in an outside
email reach private files and leave by email. Denying E3 removes
the send leg.
```

## Where this goes wrong

- **Write access without confirmation.** Xero's [remote MCP FAQ](https://developer.xero.com/faq/remote-mcp) says its V1 tools "do not elicit user confirmation" and advises asking your agent to confirm before writing back to Xero. Assume other tools behave the same until you check. Our [Xero integration guide](/integrations/xero/) covers the options.
- **"Allow always" clicked once.** Anthropic advises using it only for servers and tools you trust to run unsupervised.
- **Shared credentials.** On Claude Team and Enterprise, a connector set up with a fixed key gives every user the same access, so limit that key.
- **Apps on by default.** OpenAI's [admin controls page](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-for-plugins-and-apps) says apps are enabled by default in ChatGPT Business; admins should decide which stay on.
- **Permissions set once, never reviewed.** The NCSC's [agentic AI guidance](https://www.ncsc.govt.nz/assets/guidance/Documents/Careful-adoption-of-agentic-AI-services_FINAL.pdf) describes an agent granted broad access to "reduce friction", with permissions evaluated only at deployment, that let an attacker approve payments.

## Check your work


- I can name the four questions to ask before connecting an AI tool.
- My matrix denies every permission the task does not need.
- Every remaining write or send has a named person who confirms it.
- I checked for the read, private data and send combination and removed a leg.
- Each connection has an owner and a review date.
- I know how to revoke a connection in the AI tool and in the connected service.


## Where to go next

Next in the pathway: [building a no-code AI prototype](/learn/building-a-no-code-ai-prototype/), where you can apply this matrix to your own assistant. For the ideas behind connected assistants, see [understanding AI agents](/learn/understanding-ai-agents/), and test any agent against the [AI agent acceptance checklist](/resources/ai-agent-acceptance-checklist/). Engineers should read [agent permissions and approvals](/engineering/agent-permissions-and-approvals/) and [MCP for business systems](/engineering/mcp-for-business-systems/). Before connecting AI to finance or client systems, an [AI security review](/services/ai-security-review/) checks the matrix against how the systems really behave.

## Questions people ask

### What does it mean when an AI connector asks to act on my behalf?

It means the AI uses your account's access, usually through an OAuth sign-in, rather than an access level of its own. Anthropic's help centre describes connecting a service as granting Claude the ability to access and potentially modify data within it based on your permissions. Whatever you can open, change or send, the connected AI may be able to as well.

### Does Microsoft Copilot see every file in our company?

No. Microsoft says Copilot works with content in Microsoft Graph that the user has permission to access. The catch is that many organisations have looser SharePoint and OneDrive permissions than they realise, and Copilot makes overshared files easy to find. Tidy sharing settings on sensitive sites before a wide rollout.

### Should we allow an AI assistant to send emails?

Rarely without confirmation. Drafting is low risk because a person reviews before anything leaves. Sending is externally visible and cannot be undone, and an assistant that reads outside email and can send email is exactly the combination prompt injection exploits. If sending is genuinely needed, require approval of the exact message every time.

### Who in a small business should approve AI connections?

Name one person, usually whoever administers Microsoft 365 or Google Workspace, and route all new connections through them. In ChatGPT Business, OpenAI says apps are enabled by default and admins control workspace-wide availability, so an admin should decide which apps stay on. Record each approved connection, its scope and its owner.


## Sources

- [Get started with custom connectors using remote MCP](https://support.claude.com/en/articles/11175166)
- [Admin controls, security, and compliance for plugins and apps](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-for-plugins-and-apps)
- [Data, privacy, and security for Microsoft Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy)
- [Remote MCP server FAQ](https://developer.xero.com/faq/remote-mcp)
- [Careful adoption of agentic AI services (PDF)](https://www.ncsc.govt.nz/assets/guidance/Documents/Careful-adoption-of-agentic-AI-services_FINAL.pdf)
- [OWASP Top 10 for LLM Applications 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/)

Published by Levy Street (https://levystreet.com), Wellington, New Zealand.