Connect an AI assistant to business tools by giving it a clearly owned identity, the narrowest access needed for a specific task, and only approved ways to act. Enforce permissions in the connected services—not just in the assistant’s instructions—and require human approval for consequential actions. Then check what data the assistant and connector providers retain, test logging and revocation, and review the setup when it changes.
Plan the task and its boundaries first
Before enabling a connector, define what the assistant is meant to do and where its authority stops. “Find the latest approved policy and answer employee questions” is easier to secure than “review everything and take whatever action is needed.”
As an Amazon Associate I earn from qualifying purchases.
- Task: State the specific business outcome.
- Users: Identify who may invoke the assistant and who owns its configuration.
- Sources: Name the specific folders, mailboxes, records, or other data it needs.
- Allowed operations: List the permitted reads and writes separately.
- Prohibited outcomes: Specify data it must not return or actions it must not take, such as sending confidential material outside the organization.
These boundaries help limit the impact of unexpected content, but instructions to the model are not an authorization system. The connected service must independently check whether the identity can access a resource or perform an action. OpenAI’s prompt-injection overview explains how third-party content can try to mislead an assistant.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Choose whose identity the assistant uses
There are two common patterns. Neither is automatically safer: compare the effective access the assistant receives across all connected services, how actions are attributed, and how reliably access can be removed.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Pattern | Whose authority is used | Benefits | What to manage |
|---|---|---|---|
| Delegated user access | The signed-in user’s permissions, when the service enforces them for the delegated request. | Can preserve existing user-level access boundaries and make actions attributable to the user. | Understand the delegated scopes; confirm each downstream service enforces the user’s permissions; securely pass and revoke tokens. |
| Dedicated agent or service identity | A separate identity with explicitly assigned task roles. | Can make ownership and operational access clearer, and allow a narrowly scoped role for a defined task. | Assign a named owner; manage the identity lifecycle, access reviews, audit, and prompt revocation when the task or owner changes. |
Microsoft recommends treating agents as principals with managed identities, explicit roles, and tightly scoped tool use in its July 16, 2026 guidance. Its guidance on governance and security across an organization also describes honoring user permissions when an agent works on a user’s behalf. Whichever model you choose, make the effective access understandable and revocable; avoid shared credentials and broad administrator grants.
Limit permissions, tools, and actions
Give the identity and assistant only what the defined task needs. Access can add up across connectors: permissions that look narrow one service at a time may combine into broad effective access. Microsoft’s least-privilege guidance for AI agents recommends scoped roles, explicit resource, data, and action boundaries, and tool allowlists.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Restrict access to named resources or collections instead of an entire drive, mailbox, or workspace where practical.
- Separate read-only retrieval from write-capable tools and identities where the platform allows it.
- Enable only the specific connector actions the task requires; disable unused tools.
- Use temporary privilege elevation for exceptional workflows rather than leaving extra permissions enabled.
- Constrain destinations for actions such as email or export, and have the downstream service recheck authorization at the time of the action.
Start with read-only behavior where it can meet the need. Require a person to review consequential actions—including external email, deletion, export, purchases, and permission changes—before they happen. OpenAI’s connector guidance says, “Always require approval for sensitive actions”; treat that as its recommendation for MCP and connector integrations, not as a substitute for your organization’s own controls.
Assess the connector as a separate trust boundary
A connector can receive data, request scopes, or carry out actions. Check both the assistant product and the connector provider: who operates it, what it can access, where information goes, and what terms apply. Prefer official integrations and provider-hosted servers where suitable; review third-party proxies and aggregators as separate providers rather than assuming the connected app’s terms cover them.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Confirm the operator. Identify who runs the connector or remote server and whether it is an official integration or a third-party service.
- Inspect permissions and actions. Review the scopes requested, the operations exposed, and the destinations that can receive data.
- Review changes. Recheck permissions and behavior after connector updates or configuration changes.
- Control custom requests. Direct HTTP calls can bypass governance or identity controls provided by a secured connector. Confine or prohibit them in production unless they have been reviewed.
- Keep a record. Log what information is shared with the connector and which identity initiated the exchange.
For OpenAI API integrations, the MCP and connectors guidance warns that remote MCP servers are third parties subject to their own terms and may access, send, receive, or act on data. It recommends trusted provider-hosted servers, caution around prompt injection, approval for sensitive actions, and review of shared data and third-party retention and residency. The same page states that Responses API calls with store=true are logged for 30 days unless Zero Data Retention applies. That is a product-specific statement; verify the current documentation and the configuration that applies to your account before relying on it.
Reduce exposure in source data and outputs
An assistant can only respect access boundaries that exist and are enforced in the systems it searches. Review oversharing before connecting a broad data source: a file or site available to more people than intended may also become discoverable to an assistant operating with those permissions.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Review sharing on relevant files, folders, sites, mailboxes, and collaboration spaces; correct access that is broader than intended.
- Use sensitivity labels and data loss prevention (DLP) policies where supported and appropriate to the data.
- Limit retrieval to sources appropriate for the task, rather than indexing or connecting everything by default.
- Define what the assistant may include in answers or send to external recipients; isolate internal data from public-facing agents.
These controls are platform-specific. For Microsoft 365 Copilot, Microsoft discusses oversharing, sensitivity labels, DLP, and controls such as Restricted SharePoint Search and Restricted Content Discovery in its Zero Trust guidance. Those named controls apply to Microsoft’s environment, not to assistants generally.
Treat documents and tool results as untrusted input
Emails, webpages, documents, and connector responses may contain instructions intended to manipulate the assistant—for example, to reveal information or invoke a tool. This is indirect prompt injection. A filtering layer may help, but it cannot replace narrow permissions, restricted tools, downstream authorization, or review of risky actions.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Pay particular attention to workflows that let content influence an external action. Microsoft’s Copilot Studio security guidance discusses risks involving unauthenticated agents, direct HTTP requests, and email actions whose recipients or content are dynamically controlled. These are implementation-specific examples; the broader lesson is to ensure that untrusted content cannot choose an unrestricted destination or bypass the service’s authorization checks.
Check retention, processing, and account controls
Review the terms and configuration of the assistant workspace and each connected provider separately. Establish whether connecting a source creates an index or copy, whether conversations or app activity are retained, what compliance logs cover, and how to disconnect the account and revoke its tokens. Check applicable processing and data-residency terms for the actual product, region, and plan rather than extrapolating from another provider’s settings.
For OpenAI Business, Enterprise, and Edu workspace products, OpenAI says workspace content is not used to train its models by default. Its workspace apps security and compliance article also says that non-synced app data sent to an external service is subject to that provider’s terms, and that layered controls reduce but do not eliminate prompt-injection or unauthorized-access risk. These statements apply to the workspace products and settings described there—not to every assistant or connector.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteTest authorization and plan for changes
Test the complete workflow before production, including what happens when an action is unauthorized, a user loses access, a connector is unavailable, or content tries to redirect the assistant. A polished final answer alone does not show which tools were called or whether authorization was checked at each step.
- Try to retrieve data outside the intended scope and verify that the source service denies it.
- Test prompt-injection scenarios using documents or tool results that ask the assistant to expose data or take an unrelated action.
- Confirm that sensitive actions stop for approval and that approval shows the action and destination clearly.
- Record the agent identity, effective scope, tool call, target resource, action, and relevant authorization decision.
- Exercise account disconnection, token revocation, and emergency disablement; confirm access actually ends.
- Repeat the review after adding a source, tool, permission, workflow, or deployment environment.
For a practical sign-off, confirm that the task and owner are named, identity and scopes are explicit, only needed tools are enabled, sensitive actions require approval, source sharing and output destinations have been checked, provider terms are understood, and logging and revocation have been tested.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
