# What an AI agent can safely do in your CRM

> What an AI agent can safely do in your CRM over an MCP server: read narrowly, propose with evidence, and change only with a person's approval.

Canonical: https://www.runtheworld.ai/guides/what-an-ai-agent-can-safely-do-in-your-crm

Updated: 2026-10-06

## Give it a ladder, not a master key

An agent's reach should grow one step at a time. Runner's MCP endpoint uses these boundaries:

## Permissions stay current

A connection gets the projects a person approved, and the tools their role permits. Runner checks both again on each request.

Revoke the connection or change the role, and the next request uses that decision.

## Propose before you write

Runner's proposing tool drafts a contact note in the agent's ledger. Each proposal cites at least one record and explains why it supports the note. A person reads it, then applies, edits or discards it where they already write notes.

The agent and person have separate identities. The agent records no outcome for its own proposal; an outcome is written once. Caps per contact and per hour keep a loop from filling the queue.

## Approve one exact call

For an approval-gated change, the first call files a request and is refused. A person decides it in Runner.

The approval binds the tool, its version, the organization, the accountable person and the exact input. Change an argument and the call needs its own approval. An approval with no expiry counts as expired.

Every change tool must declare evidence, an undo plan and limits before the server starts. Limits are checked before anyone is asked to approve.

## Stop at the size of the problem

Owners and admins can pause agent traffic at four sizes:

- One tool — stop repeated calls.
- One project — contain the affected work.
- One person's connections — pause their delegated access.
- The workspace — stop agent traffic across it.

## Before you connect

Ask any MCP server for clear answers to these:

- Are permissions checked on every request?
- Does a proposal leave the customer's record untouched?
- Does approval bind one exact call?
- Does every change have an undo plan and limits?
- Can you stop at the size of the problem?