How do I safely let AI update our business systems?
Giving AI broad write access is easy. Making sure it has the right context before the write, uses the right person's authority, and pauses when approval is required is the harder part. The write itself should run under a policy you set: allowed on its own, held for your approval, or refused.
What you actually wanted delegated
Nobody sets out to give an AI write access. What people want is the thing at the end of the task: the record brought up to date after the call, the ticket filed and routed, the invoice raised, the follow-up sent, the report posted where the team will read it. The reason to care about safety is that this is the half where the value is.
An AI that can only answer questions hands the last step back to a person. That step is usually the boring one, and it is where the time goes.
Five ways teams handle the last step
Read-only access
The safest thing that still helps. The AI drafts and a person performs the write, which is a real and defensible choice.
Copy and paste
The AI produces the update, a person moves it into the system. Nothing can go wrong unsupervised. The effort never goes away either.
A sandbox first
Try it against a test environment. Good practice, though a test system cannot tell you whether the AI knew your real rule.
One service account with broad scopes
Fast to set up and it does work. Broad service identities also make it harder to tie the action back to the person and policy that authorized it.
An automation platform
Strong for a fixed path that runs the same way every time. Less suited to a decision that depends on the situation.
Where read-only is genuinely the right setting
For anything irreversible, high value, or externally visible, keeping a person on the write is correct and should stay that way. A quarterly filing, a customer-facing commitment, or a deletion is not the place to remove review.
The useful question is not whether to have a gate. It is whether every action needs the same gate. Treating a lookup and a refund the same way is what makes people either turn the whole thing off or wave it all through.
Four ways the last step goes wrong
| The setup | What it costs |
|---|---|
| Read-only, forever | The AI stops one step before the work. The person becomes the integration between the AI and the tool. |
| Broad write access, no gate | Without a purpose specific gate, a wrong decision can become a real write before anyone catches it. |
| Approval on every single action | A person is asked to approve forty lookups to reach one real decision, so they stop reading the prompts. |
| Access granted, rules missing | The most expensive one. The write was authorized and still wrong, because the AI never had the company's rule for that situation. |
The context that guided the decision travels into the action
When a task needs another system, HexaHQ runs it as a capability: a narrow, named operation against that system's API. The relevant company rules resolve before the step runs, so the AI is deciding with your policy in front of it rather than inferring one.
Each capability carries its own setting: allow it to run on its own, ask a person first, or refuse it. That is set per operation rather than per tool, which is what lets a lookup be automatic while a refund is not. Reads usually run; writes, sends, and deletions are where the ask belongs.
Every person connects their own account, so the write happens with their permissions and their name on it. What was resolved, what was approved, and what ran is recorded, so the question "who did this and on whose authority" has an answer.
Tools that ship an MCP server connect directly. For the much larger set that do not, describe the API and your AI authors the capability, with no server for you to build or host.
Sharing a connection is not sharing everything behind it
A team can share the Salesforce connection while each person still signs in as themselves, so a write carries their permissions and their name rather than a shared account's. The rules that decide what they may write are scoped the same way. The negotiated exception on one account reaches the two people who own it, and their teammate's AI never sees it and never offers it.
A renewal update that follows the policy
-
A real request, in the AI you already use
"Bring the Northwind renewal up to date after today's call and flag anything finance needs to see."
-
The rules arrive before the decision
The renewal stage rule, the multi-year discount limit, and the note that this account has a negotiated exception all resolve with the task.
-
The write meets its policy
Reading the account is allowed on its own. Changing the contract value is set to ask, so it is held with a plain description of what it will do.
-
Approved, executed, recorded
The person approves. The update is written to Salesforce under their own account, and the resolution, the approval, and the execution are recorded.
Questions people ask next
How do I approve AI actions before they happen?
Set the operation to ask. The AI prepares the action, describes what it is about to do, and waits. Approval is per operation rather than per tool, so you are not asked about lookups.
How do I let AI act in Salesforce safely?
Connect Salesforce under each person's own account, give the AI the company's rules for the situation, and set the writes you care about to ask. A read can run on its own; changing a contract value does not have to.
Can some actions run without approval?
Yes, and they should. If everything asks, nobody reads the prompts. The point of setting policy per operation is that the gate lands where a mistake would matter.
What stops the AI from acting as someone else?
Each person connects their own account, so an action runs with their permissions and their identity. Credentials are held server-side and are never passed through the chat.
Can I prove what the AI did?
Yes. What was resolved, what was approved, by whom, and what ran are recorded, which is what lets you answer the question after the fact rather than reconstructing it.
What if the tool has no MCP server?
Most do not. Describe the API and your AI authors a narrow capability for it. There is no server for you to build or host.
Related pages
Let the AI finish the task, under your rules.
Connect a system, set what needs approval, and keep the record. Free to start.