An AI agent connected to your CRM: what should it be allowed to do?

Retrospective for 20–26 July 2026.

An assistant that finds a customer record is useful. An assistant that changes a discount, an invoice status or a contact’s details raises a different question: did you actually give it permission? Connecting an AI agent to a CRM is not simply an integration task. It is a decision about what the agent can read, prepare and carry out.

On 24 July 2026, n8n published an AI agent governance guide covering identity, permissions, runtime controls and traceability. For a small business, the practical lesson is straightforward: define the boundaries before connecting the tools, rather than investigating an unexplained change afterwards.

Three different levels of authority

The first level is read-only access. The agent retrieves a request, summarises a conversation or identifies the stage of an opportunity. It does not change the record. This is often a useful starting point for checking whether the necessary data is available and correctly understood.

The second level is preparation. The agent suggests an update or drafts a reply. A person can review it before it takes effect. This is particularly valuable when information is incomplete or several customers have similar names.

The third level is execution. The agent actually creates or changes something. At this point, the permitted operation, its prerequisites and its stopping conditions all need to be explicit. “Manage the CRM” is too broad to function as an operating rule.

Example: changing a delivery address

Consider an illustrative scenario, not a SWM client case study. Someone contacts support to change a delivery address. The agent can find the order and prepare an update. But if the customer cannot be identified confidently, or the order has already shipped, it should hand the request to the team rather than guess.

The checks concern the right person, the right order, whether a change is still possible and the required authority. A convincing model response does not replace any of these checks. The same principle applies to contact information, discounts and sales follow-ups.

A small permission matrix beats a vague instruction

Before launch, list the possible operations and record four things for each: who owns it, which information is needed, what approval is required and how to verify the outcome. This matrix can fit on a single page. What matters is that it describes actual operations rather than broad intentions.

Also define when the agent should say that it cannot reach a conclusion. Duplicate contacts, contradictory documents or a new request arriving during processing make useful test cases. A good test does not only show that the agent completes an authorised action. It also shows that it declines an unauthorised one.

Keep a proportionate record

For a change, the team should be able to find the original request, the decision and the resulting state. That record supports troubleshooting and recovery. It should remain proportionate: retaining sensitive information “just in case” is not a monitoring strategy.

Smart Wise Monkey’s AI consulting can begin with these boundaries before moving to automation implementation. The goal is not to give an agent unrestricted access. It is to assign a clear, useful task whose execution your team can understand and check.

Let’s define what your agent may do independently and what should still require your approval.