---
title: "How to Connect AI to Your Business Tools"
seoTitle: "How to Connect AI to Your Business Tools"
description: "Learn four routes for connecting AI to business tools and the permissions that decide whether an assistant can read, change, or delete records."
datePublished: "2026-09-27T20:04:00Z"
dateModified: "2026-11-01T20:29:00Z"
category: "ai"
imageAlt: "A woman examines a tagged brass key at her desk while a colleague holds a tablet beside her."
tags: ["ai-integration", "mcp", "oauth-scopes", "ai-connectors", "ai-automation"]
faq: true
headQuery: "how to connect ai to your business tools"
featuredImageFile: "/blog/art/en/connect-your-tools-hero.4ab5cc42.webp"
---
Connecting AI to a business tool means giving an AI application a credential to call the tool's API on someone's behalf. To decide how to connect AI to your business tools, pick a built-in connector, an automation platform, your own API code, or an MCP server; then sign in through an OAuth consent screen or supply an API key and decide what the grant allows.
The consequence is easy to miss: “connected” says nothing about whether the AI can read, create, update, or delete records. Those permissions are decided separately, in different places. The vendor pages cited here were read on 1 November 2026.
## Four routes connect AI to business tools
The four routes for connecting AI to business tools differ in who builds the available actions, where the credential is stored, and what starts a request. A route can overlap with another: Zapier, for example, can expose its actions through MCP.
**Built-in connectors** provide actions assembled by the integration's vendor and accessed from an AI application. ChatGPT calls these integrations apps. Claude members generally connect individually, so Claude can access the tools and data available to that person; a connector using a shared credential, such as an API key, is an exception. Gemini Enterprise Business edition lists Gmail, Calendar, Drive, and dozens of third-party connectors, some marked for read-only actions. For the separate choice between a configured assistant and a tailored automation, see [generic versus tailored AI](/blog/generic-vs-tailored).
**Automation platforms** hold their own stored connections and run actions when a trigger or a tool call starts a job. Zapier MCP charges two tasks for each successful tool call. In [Zapier's example](https://docs.zapier.com/mcp/overview/usage), searching and updating 10 records takes 11 tool calls and consumes 22 tasks; a failed call consumes none.
**Direct API code** uses an integration your developer writes against the business tool's own interface. The code holds the key or token you give it, and its available operations depend on both the code and the grant behind that credential. A scheduled job, an event, or an AI application can start the code, depending on how the integration is built.
**An MCP server** exposes tools to an AI application through Model Context Protocol, an open standard Anthropic announced on 25 November 2024. The server may sit on the same machine as the AI application or run remotely. Claude and ChatGPT can act as MCP hosts, discovering the tools a server offers and requesting calls to them.
## How an MCP connection works
An MCP connection lets an AI application discover and call capabilities exposed by a server. The AI application is the **host**; it opens one MCP client for each server it connects to. The server can expose tools, which perform actions; resources, which provide data; and prompts, which are reusable templates.
A host can discover a tool and send a request with the arguments the tool needs. The server handles the request and returns a result to the host. The tool's presence does not establish what the credential can reach: a server can offer a contact update action while the current token lacks the scope needed to run it.
A local server runs over standard input and output, usually called **stdio**, and retrieves credentials from its environment. A remote server runs over Streamable HTTP. MCP authorization is optional; for HTTP, the specification recommends OAuth, with an authorization design based on OAuth 2.1.
When a token lacks a necessary permission, a server can return HTTP 403 with an `insufficient_scope` challenge naming the scope. The client can then ask the user to authorize the additional scope. For a hypothetical server at example.com, that response could look like this:
```http
HTTP/1.1 403 Forbidden
WWW-Authenticate: Bearer error="insufficient_scope", scope="crm.objects.contacts.write", resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"
```
The [MCP authorization specification](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization) describes that scope challenge and the renewed authorization. A tool can also carry an annotation such as a read-only hint, but the MCP specification says clients must treat annotations as untrusted unless the server is trusted. A label supplied by the server is not a substitute for checking the grant.
## Four layers decide what a connection can do
An AI connection's available actions depend on four layers configured in different places. The way I break it down is to check what the integration can do, what its credential permits, whose identity it uses, and which actions an administrator has enabled.
| Layer | What it decides | Where you check it |
|---|---|---|
| Built actions | Which operations exist in the connector or server at all | The connector's object and action table, or the server's tools list |
| Granted scope | Which operations the token may call | The OAuth consent screen and the provider's scope documentation |
| Whose identity | Whether access is capped by a signed-in person's rights or held by an application or shared credential | The authorization type, account used to connect, and provider documentation |
| Admin and confirmation controls | Which actions are enabled and when the AI asks before using available access | Workspace action controls and app permission settings |
:::figure{src="/blog/art/en/connect-your-tools-four-layers.2bbe39e1.webp" alt="An AI request passes gates for built actions, granted scope, identity, and admin controls." width="1440" height="810"}
A request passes four separate gates, and any one can stop it. Different people configure the gates in different places, from the integration's action list to the workspace's admin controls.
:::
The scope name deserves a close read. HubSpot describes `crm.objects.contacts.write` as “Create, delete, and make changes to contacts.” Its [scope list](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/scopes) has no separate contact delete scope, so a grant labeled write includes delete permission even if a particular connector has no delete action.
Microsoft's application permission `Mail.Read` allows an app to read email in all mailboxes without a signed-in user. An administrator can use RBAC for Applications to grant mail access scoped to specific mailboxes. The scoping only takes effect if the unscoped `Mail.Read` grant in Microsoft Entra ID is removed, because the two grants add together.
Identity changes the boundary as well. With Microsoft Graph delegated permissions, an app acts for a signed-in user and cannot access what that user could not access. With application permissions, the app can access data associated with the permission; for example, `Files.Read.All` can permit reading any file in the organization. Microsoft's [permissions overview](https://learn.microsoft.com/en-us/graph/permissions-overview) makes that distinction explicit.
Finally, ChatGPT Enterprise and Edu administrators can allow all actions for an app, allow only read actions, or choose a custom set. Confirmation settings sit alongside those action controls: an enabled action can be available even when ChatGPT is configured to ask before using it.
## Does asking before acting limit what a connected AI can reach?
A confirmation prompt changes when ChatGPT asks, not the access already granted to an app. ChatGPT's default app permission, **Important actions**, allows reads automatically and asks before actions that may have a meaningful effect outside ChatGPT.
[OpenAI's app documentation](https://help.openai.com/en/articles/11487775) states: “App permissions do not grant an app new access.” Changing the setting changes when ChatGPT asks before using access the app already has. If an app can read a set of records, selecting a confirmation policy does not remove those records from its scope.
The same distinction applies when an administrator approves a provider scope or changes a future-action policy. Approving a provider scope does not automatically enable a new action, and changing the policy for actions an app adds later does not remove existing provider consent. Some changes may require the user to reconnect or reauthorize the app.
Claude has a related control for connector calls. Anthropic advises choosing **Allow always** only for a server and tool you trust to run unsupervised. During Research, Claude can call connector tools without further approval, so Anthropic advises disabling tools that write to external apps. Check the tool's actual capability before treating an approval preference as a permission boundary.
## A hypothetical HubSpot connection
This hypothetical example uses a 25-person company on HubSpot and a sales rep whose HubSpot role lets her view only her own deals. She connects HubSpot to ChatGPT Business to ask about her pipeline and prepare record changes.
Start with the actions. [HubSpot's connector documentation](https://knowledge.hubspot.com/integrations/connect-your-hubspot-account-to-chatgpt), last updated 19 October 2026, lists read, create, and update actions for contacts, companies, deals, tickets, and custom objects. None of the objects in its table supports delete. For bulk creation or updates, the connector caps a request at 10 records.
Next comes the grant and the identity behind it. The company should inspect the data permissions approved for the connector, while the rep's HubSpot permissions limit which records she can access. Because the connector respects those permissions, she can see only the deals her role permits her to view. A different rep's connection can return a different set of deals.
ChatGPT shows proposed changes before execution, and HubSpot's audit log attributes each action to both the user and the ChatGPT connector. If the company uses ChatGPT Enterprise or Edu, an administrator can also configure the app to allow only read actions. The documented read-only action control is specific to those plans; the example's Business workspace should not assume it has that same control.
Now change the route. If the company builds its own integration with an OAuth app granted `crm.objects.contacts.write`, the token has permission to delete contacts, subject to the applicable rights and controls. Whether its code actually exposes a delete action is a separate question. If the company uses Zapier MCP for Zapier's search-and-update example, the 10-record job consumes 22 tasks.
A HubSpot developer changelog entry of 24 July 2025, announcing an expanded ChatGPT connector, described read-only access to core CRM objects: contacts, companies, deals, and tickets. The knowledge base article updated on 19 October 2026 documents create and update actions. My rule is to read the action table, not the word connected: a connector's capabilities can change after launch.
## A connection differs from an upload, an API, and a synced copy
An AI connection gives an application a route to a tool; an uploaded file gives a chat or project a copy from one moment, with no live access or write path to the source. A file can answer questions about its contents, but uploading it does not grant the chat an action for updating the original record.
MCP and an API also occupy different places in the connection. An API is the business tool's own interface. An MCP server wraps capabilities so an MCP host can discover and call tools, and the server will usually call the business tool's API underneath. MCP gives the host a common way to discover capabilities; it does not replace the permissions imposed by the tool receiving the call.
A live query and a synced copy differ in when data moves. Gemini Enterprise can use a federated-search-only data store, where the query string goes to enabled third-party search backends. ChatGPT apps can also sync content ahead of time into an index, so ask which path a proposed connection uses when current records or data location affect the job.
OpenAI says ChatGPT Business, Enterprise, and Edu workspace content, including information accessed through apps, is not used to train its models by default; the [vendor data terms comparison](/blog/data-with-vendor) covers what each provider says about training on your data.
## Five checks for a connection you can inspect
A connection deserves five observable checks before and after you authorize it. Record the answers alongside the name of the account that owns the grant, so someone can inspect the same settings when the job changes.
1. **Read the action table.** Mark which operations exist for the records involved: read, create, update, and delete. Check the actual object you intend to use, since an action available for contacts may not be available for another object.
2. **Read the scope strings.** Inspect the OAuth consent screen and look up unfamiliar scopes in the provider's documentation. Check what a write scope includes before approving it.
3. **Identify whose access applies.** Confirm whether the connection acts as a signed-in user, as an application, or through a shared key. Check the rights of that identity in the source tool.
4. **Set action controls for the job.** Where the workspace provides action controls, leave write actions disabled until the job needs them; otherwise set available confirmation controls to ask before changes. Verify both the enabled actions and the prompting setting, because they govern different things.
5. **Plan the reconnection.** Microsoft's default refresh token lifetime is 90 days for most scenarios and 24 hours for single-page apps, with earlier revocation possible. Google refresh tokens can stop working after six months without use, among other reasons. After a HubSpot Super Admin updates the connector's data permissions, each user must reconnect the connector to gain access to the newly approved data. The [automation failure guide](/blog/automations-break) explains what an expired connection can look like in a running automation.
The [build-versus-buy AI automation guide](/guides/ai-automation/build-vs-buy-ai-automation) works through choosing a route by cost, data location, and exit. Use it after identifying the actions and permissions the job needs.
If you want the scopes chosen and the connection built and run for you, [Iron Goo's operations service](/services/operations) builds connections with audit logging on every action and runs them.