Before connecting an AI agent to customer records, ask what job it will do, which identity it will use, exactly what data and actions it can reach, and how you will monitor and revoke its access. Require evidence that permissions are enforced by the CRM and connected services—not merely instructions in the agent’s prompt—and test the controls before production.
The questions below apply across CRM platforms. Salesforce and Microsoft guidance provide concrete examples, but their controls and feature availability are platform- and deployment-specific; verify the equivalent behavior in your own configuration.
As an Amazon Associate I earn from qualifying purchases.
Who owns the agent, and what is it for?
Give the agent a defined purpose and a named human owner before granting access. Ask:
- What specific task is the agent allowed to perform, and what outcomes are out of scope?
- Who owns it, approves its access, reviews changes, and responds if it acts incorrectly?
- Does it have a unique, dedicated identity, or does it share a human or service account?
- Can you attribute each CRM change to the agent identity, and distinguish it from actions taken by a person?
Microsoft recommends a dedicated agent identity, an owner or sponsor and an approver, with the agent’s purpose, approved data, tool dependencies, and operating environment documented. See Microsoft’s least-privilege guidance for AI agents. In Salesforce, an agent user’s username can appear in fields such as Created By, Last Modified By, Owner, or audit fields; see Salesforce’s guidance on agent user permissions.
#1 Best Overall
Which identity will act, and whose permissions apply?
Do not assume that an agent always operates as itself or always inherits the permissions of the person using it. Ask which principal is active in each workflow, and verify the resulting permissions and audit attribution in the actual session.
| Identity pattern | What to verify |
|---|---|
| Dedicated agent identity | Confirm its permissions are limited to the agent’s task, its owner and approver are recorded, and its activity can be attributed and revoked. Microsoft recommends a unique, lifecycle-managed identity; Salesforce documents an agent-user context. |
| Delegated or authenticated user context | Confirm whose permissions the agent uses for each action, whether the user’s access is checked again by downstream tools, and whether logs preserve the acting user as well as the agent. Salesforce documents an authenticated-user context; implementation details depend on the configuration. |
These patterns are not interchangeable guarantees: the effective permissions depend on the CRM, identity setup, connectors, and downstream services. Salesforce describes its platform-specific behavior in Agentforce Security and the Shared Responsibility Model; verify equivalent details with your CRM and connector vendors.
What customer data can it access?
Ask for a permission map that covers the whole workflow, not just the CRM login. Specify the scope in terms administrators can verify:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Which objects, fields, records, and customer segments can the agent read?
- Does it need to create or edit records? Does it need to export data, delete records, or change permissions?
- Which sharing rules, field-level permissions, organization-wide defaults, filters, and user scopes apply in the agent’s actual session?
- What effective permissions result when roles, tools, flows, connectors, and downstream services are considered together?
- Can access be restricted by task, user, record, or time?
Start with the narrowest workable scope and add access only when a demonstrated task requires it. Salesforce recommends beginning with a minimally accessible agent user, then reviewing roles, object permissions, organization-wide defaults, and sharing; it also describes filters and variables at subagent and action levels to restrict record access. Microsoft advises reviewing combined effective permissions across roles, tools, and downstream systems, and using task-scoped access. Their platform-specific advice is in Salesforce’s permission guidance and Microsoft’s least-privilege guidance.
Rank #2
- Pre-designed templates for both business and personal use
- 10,000 clipart images and 100 fonts
- Notes table for history and to-do items
- Sort, filter and index
- Calculation & totaling
Which tools and actions can it invoke?
List every tool and connector the agent can call, then distinguish allowed actions from prohibited ones and actions that require approval. Ask:
- Which tools are explicitly allowlisted, and are unreviewed tools denied by default?
- Can the agent chain actions across systems? Where does authorization get checked in that chain?
- Are read and write capabilities separated? Which actions are forbidden, and which require a human approval before execution?
- Does each tool and downstream service independently authorize each action, or does one broad credential grant authority across the workflow?
- What happens if approval, a policy lookup, logging, or risk classification is unavailable or fails?
Microsoft warns that agents can combine available tools in ways that increase impact; its guidance recommends reviewing tool access and effective permissions. The Microsoft AI agent shared responsibility model describes per-tool permissions, per-action authorization checks, and human approval for high-impact actions. OWASP’s AI Agent Security Cheat Sheet recommends failing closed when key checks fail, and using short-lived authorization artifacts and replay protection for irreversible operations. A prompt that says “only do this” is not an access-control boundary; enforce limits in the CRM, tools, and downstream services.
Could customer content redirect the agent?
CRM notes, emails, attachments, and retrieved web content can contain instructions that conflict with the task. Treat that material as untrusted input, even when it comes from a customer record or a connected source. Ask:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Could retrieved content cause an unauthorized lookup, export, email, deletion, or permission change?
- What authorization check prevents such an action outside the model’s own instructions?
- Which customer fields are sent to the model, retained in memory, recorded in logs, or passed to tools?
- Can sensitive fields be excluded or masked when they are not necessary? How are logs protected from storing credentials or unnecessary personal data?
- How is long-lived memory limited, and how are outputs and logs monitored or filtered?
OWASP identifies direct and indirect prompt injection—including malicious instructions embedded in external content—as an agent security risk. Microsoft advises classifying and governing sensitive data, limiting long-lived memory, and monitoring and filtering outputs and logs. Its shared-responsibility guidance also makes clear that the organization remains accountable for data passed to tools and written into agent memory. See OWASP’s agent security guidance, Microsoft’s guidance on reducing autonomous agent risk, and the Microsoft shared responsibility model.
What evidence will show what the agent did?
Ask the team to demonstrate that audit records capture the underlying tool actions—not only the agent’s final answer. For each relevant action, verify whether logs record:
- The agent identity and, when applicable, the delegated user or on-behalf-of context.
- The effective permission scope, tool call, action, and target resource.
- An approval path and correlation ID that let reviewers follow the workflow across systems.
- Who reviews alerts and activity, and how long evidence is retained under organizational policy.
Microsoft’s least-privilege guidance calls for end-to-end action traceability, including identity, role, effective scope, action, resource, and correlation context as applicable. A record of only the generated answer may not establish which tools were called or which changes occurred. Salesforce also notes that agent activity can appear in record audit fields; confirm which fields are populated in your setup. See Microsoft’s traceability guidance and Salesforce’s agent user guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How will you test, monitor, and revoke access?
Test the boundaries before production
Use a sandbox or equivalent non-production environment to demonstrate actual effective permissions. Include tests for unauthorized record access, unintended writes, prompt injection, approval bypass, and chained tool behavior. Salesforce recommends sandbox testing; OWASP recommends structured security testing before production and after material changes to prompts, tools, memory, retrieval, policies, or model providers. See Salesforce’s permission guidance and the OWASP checklist.
Free tools Windows power users keep installed
One-click scans. No signup required.
Make monitoring and response ownership explicit
Name the people or team responsible for reviewing logs and alerts, and define how incidents are handled. Agree what events trigger another access review, such as a changed workflow, a new tool, expanded data access, a model or provider change, or a move into production.
Prove the off switch works
Before launch, test disabling the agent, rotating credentials, invalidating tokens, and removing stale permissions in the CRM and every connected service. Microsoft specifically recommends testing these revocation steps. Document who can perform them and how to verify that access has actually ended; a disabled agent with a still-valid downstream credential is not fully revoked. See Microsoft’s identity and revocation guidance.
What to require before approving access
Make approval conditional on evidence, not a vendor assurance or feature label. A practical go/no-go review should establish:
- A documented purpose, named owner and approver, and attributable identity.
- A permission map covering CRM records, fields, tools, connectors, and downstream services.
- Explicitly allowed and forbidden operations, with approval gates for high-impact actions.
- Data handling rules for model context, memory, tools, and logs.
- Sandbox test results, action-level auditability, monitoring ownership, and a tested revocation procedure.
Microsoft’s enterprise guidance offers useful identity and governance patterns, but availability and enforcement depend on deployment, identity configuration, connectors, and downstream systems. Verify that each claimed control is enabled and observable in your own environment.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
