How do I give an AI agent access to my CRM, email and databases?

Give the agent its own account in each system, with the narrowest permission that does the job, and start read-only. The agent never gets a raw login; it calls small functions such as find_customer or create_draft, and each function checks the permission and logs the call. Write access is added one action at a time after testing, and credentials stay in a secret store.

Updated 8 November 2026.

Ask us about your case See use cases

This page answers

How do I give an AI agent access to my CRM, email, and databases?
Can I control what information each AI agent can access?
How do I securely connect AI automation tools to my company systems?
How do I manage API keys and credentials securely across automated systems?

Narrowest permission per system

Start with the first column. Move to the second only for the actions the agent has to take.

System	Start with	Add only when needed	Avoid
Gmail (Gmail API)	gmail.readonly: view messages and settings	gmail.compose: drafts and sending; gmail.send: send only	https://mail.google.com/: full access, including permanent deletion
Outlook / Microsoft 365 (Microsoft Graph)	Mail.Read on the one shared mailbox	Mail.ReadWrite for drafts and filing; Mail.Send to send	Application permissions on all mailboxes when one mailbox is enough
CRM (HubSpot, Salesforce, Odoo)	Read on contacts and deals	Write on the specific objects and fields the agent updates	An admin user's login or API key
Database (PostgreSQL and others)	A role with SELECT on the views it needs	INSERT or UPDATE on one table, through a stored procedure or an API	A superuser or the application's own database user
Spreadsheets and drives	Access to the one file or folder	Edit on that file	Access to the whole drive

Functions, not logins

The model never sees a password or an API key. It sees a list of functions with plain names and inputs, such as find_customer(email), get_open_orders(customer_id) or create_reply_draft(thread_id, text). Each function is code we write: it checks that the call is allowed, uses the stored credential, returns only the fields needed, and writes a log line.

This is where you control what each agent may see. A sales agent gets functions for contacts and deals; a finance agent gets invoices and payments; neither gets the other's.

Credentials and data

Keys and tokens live in a secret store (your cloud's secret manager or a vault), never in code or chat history.
OAuth is used where the system offers it, so access can be revoked without changing a password.
Each agent has its own credentials, so one can be switched off without stopping the others.
Fields the job does not need, such as bank details or health data, are left out of what the function returns.
If data must not leave your premises, the agent and an open model run on your own servers.

Sources

Vendor facts on this page come from these pages, checked on 8 November 2026.

Questions

Is MCP the same thing?

MCP is a standard way to offer such functions to a model. It can be used, but the same rules apply: narrow permissions, your own functions in front of each system, and a log.

Can the agent read all our email?

Only if you give it that. Usually it reads one shared inbox, such as orders@ or accounts@, and nothing else.

What if a credential leaks?

Revoke it in the system and issue a new one; because each agent has its own, nothing else stops. The log shows what was done with it.

Agents for these jobs

Want an agent built for this?

We build AI agents in code, connected directly to your systems, with no per-task fees. Write a few lines about the work you want to automate and the systems you use; we reply to set up an online intro call.