How to control what AI agents can read and write in your CRM: guardrails for GTM AI agents

The short answer. To control what AI agents can read and write in your CRM, give each of your GTM AI agents, the part of AI for GTM that does the work, the permissions of the one person it works for, set every CRM tool to Always allow, Needs approval or Off, give each skill only the connectors it needs, and write down which fields it changes alone, which a rep approves and which only a person changes. Day AI gives every rep an agent governed this way, in place of your CRM or on top of Salesforce or HubSpot, with read tools allowed and write tools waiting for approval in chat from the start.

Safety and control are where Day AI starts, not where it ends. Each rep connects Salesforce or HubSpot with their own login, so the agent works with that rep's CRM permissions. Every value the agent writes shows its sources, and you can ask the agent what changed and why.

Say you run sales at a B2B payments company with nine reps, and you run Day AI in place of your CRM. It's 5:15 on a Thursday near quarter end, and you're thinking about how much room to give the agent. You already drew the line in its skill: it creates deals and moves stages from what buyers say, and it stops before closed-won and closed-lost. Since lunch, four calls have ended. The agent opened a new deal for a buyer who asked for a pilot, moved two others forward on what was said, and left one deal one step short of closed-won, because the signed order form came in by email and that move is yours. You open the deal, look at the email it points to, and mark it won in a few seconds. Your reps got their end-of-day follow-up drafts and never opened a field. Tomorrow their morning briefings will show the same pipeline you see now. You know what's going on in the pipeline, and the only moves you made were the ones you kept for yourself.

Where the usual answer goes wrong. Most advice on agent access starts and ends with a service account: create an integration user, give it a permission set, lock down a few fields. That gives the whole team one agent with one login, so it reads every rep's deals and writes as nobody in particular, and the only control left is all or nothing. Day AI's position is that agents do the work and people approve it: each agent works for one person, reads what that person may read, and writes only where rules the team wrote down allow. Day AI provides the context graph and agent control plane to quickly and securely upgrade your company brain. If you've already set up a read-only integration user, that was the right start.

The six guardrails for GTM AI agents, with Day AI

Read and write access to a CRM is six decisions, made in order. The first two decide what the agent can see and touch, the next three decide when it acts, and the last one lets you check every change afterward.

1. Scope reads to one person. An agent should read what the person it works for may read, and nothing more. In Day AI, an agent inherits the permissions of the person it works for, and each person sets email sharing rules: share everything or nothing by default, with exceptions by domain, address or Gmail label.
2. Put writes on that person's own login. Writes to Salesforce or HubSpot should run under the rep's own account, so the CRM's own permissions still apply. In Day AI, each person connects the Salesforce or HubSpot MCP with their own login, and the agent works with that person's permissions.
3. Set every tool. Decide tool by tool what runs without asking, what asks first and what is off. In Day AI, every tool of a connected MCP server is set to Always allow, Needs approval or Off for chat, with read tools allowed and write tools needing approval by default, and each skill works through only the connectors you attach to it.
4. Write the approval rules down. Name which fields change on their own, which go to the rep, and which never change without a person. In Day AI, those rules go into the skill in plain words, and the skill sends what needs approval to the rep by email or to your team's Slack channel.
5. Watch before it acts. A new skill that writes to the CRM should report what it would have done before it does anything. In Day AI, you ask the agent to start the skill in learning mode, and it reports what it would have done and asks for feedback before acting.
6. Check every change. Anyone should be able to see where a value came from and roll back a rule that went wrong. In Day AI, every value shows its sources, and you can ask the agent what changed and why; skills are versioned, and you can restore an earlier version.

How to set it up in Day AI

Each step below is a setting or a request in Day AI, in the app or from Claude through the Day AI MCP.

Step 1: Choose where your CRM lives in Day AI

Run Day AI in place of your CRM, with deals, people and companies kept current from your team's conversations, or keep Salesforce or HubSpot. Day AI syncs with them through their MCP servers, which allow reads and writes when the write tools are turned on. A workspace Owner saves your company's Salesforce or HubSpot OAuth app once, and then each rep connects with their own login. The shared app is not a shared login, so every write runs under the rep who connected, with that rep's object, field and record access in the CRM.

Step 2: Set what each person shares in Day AI

Each person opens Email Sharing Rules in their user settings and picks a default, share all or share none, then adds exceptions by domain, email address or Gmail label. A rep who keeps legal or HR mail private keeps it private from teammates and from teammates' agents. Your own agent reads your own mail, and an agent sees only what the person it works for can see.

Step 3: Set every Salesforce or HubSpot tool for chat in Day AI

Tool permissions set how your agent uses each tool when you work with it in chat. Open the connector in Day AI and go to Tool permissions. Tools are grouped under Read-only and Write & delete, each with a Set all menu, and every tool is set to one of three:

• Always allow. The agent uses it without asking. Reads start here.
• Needs approval. The agent asks before each use, with an Approve or Deny card in the chat. Writes start here.
• Off. The agent can't use it.

A good first setup for chat: allow the read tools, allow notes and tasks, and keep the tools that change deal stage, amount or close date at Needs approval. Turn off any write tool your team has no use for. Then set the same lines for skills in Step 4.

Step 4: Write the approval rules into the skill in Day AI

Skills are where an agent does CRM work on a schedule or when a call ends. Give each skill that writes to the CRM only the connectors it needs. When a skill runs on a schedule or after a call, it works through the connectors you attach; put every change that moves the forecast on the rep-approves list. Then write the rules into it in plain words, in three lists:

• Changes on its own: next steps, notes, call attendees attached to the deal, fields with a clear answer in the call.
• Goes to the rep to approve by email or in your team's Slack channel: MEDDPICC scores, close date, amount, a stage change backed by a call.
• Never changes without a person: closed-won and closed-lost, and anything your sales leader wants reps to think through.

When a rep corrects the skill's output by replying, the agent edits the skill so the next run follows the change, and tells the rep what it changed.

Step 5: Start each new skill in learning mode in Day AI

Ask the agent to start the skill in learning mode. Day AI's Actions and Opportunity Automation skills start there already. In learning mode the skill reads the conversations, sends you a note describing what it would have done, and asks for your feedback. Read a week of those notes, correct the rules, and when you're comfortable, tell the agent to let the skill act.

Step 6: Deploy it to the team as Template or Managed in Day AI

Publish the skill to the Skills Library on the Agents page and pick a deployment type:

• Template gives each rep's agent its own copy. Choose Template for skills that write to Salesforce or HubSpot, and each rep sets the connectors on their own copy.
• Managed stays synced to the source, so one edit reaches every agent it's deployed to. Only workspace admins create, edit and deploy Managed skills, and a Managed skill reads what's shared with the workspace. Choose Managed for the rules every rep's agent follows the same way.

The skill deployment guide covers which skills to lock and which to leave personal.

Step 7: Check what changed in Day AI

Every value shows its sources, and you can ask the agent what changed and why. Every action and answer is traced to the source conversations: the call, opening at the moment it was said, or the email it came from. Every saved edit to a skill is a new version, and you can ask the agent to restore an earlier one. From Claude, Claude Code or Cursor, connect Day AI's MCP server at https://day.ai/api/mcp; its read_object_history and read_property_history tools show how a record or a single value changed. Over that server, an agent drafts email and a person sends it. The CRM data access guide walks through the connection.

Where homemade guardrails break

• One integration user for everyone. A shared service account reads every rep's deals and writes as the integration, so nobody can tell whose agent changed what. In Day AI, each rep connects with their own login, and the agent works with that rep's permissions.
• Everyone's inbox in one pile. Pooling mail so an agent can read it exposes it to everyone with access to the pool. In Day AI, each person sets their own email sharing rules, and an agent sees only what its person can see.
• All or nothing on writes. A token with write scope can change every field, so teams either block writes or allow all of them. In Day AI, each tool is Always allow, Needs approval or Off in chat, each skill gets only the connectors you attach, and the skill's written rules say which fields change alone.
• Rules in a prompt nobody versions. A rule pasted into a system prompt changes without a record, and a bad edit stays until someone notices. In Day AI, every skill edit is a saved version you can restore.
• No answer to "why did this change?" A field written by a script has no source, so the rep can't check it and the leader can't trust it. In Day AI, every value shows its sources, and you can ask the agent what changed and why.
• An agent that sends on its own. An agent wired to a mail API can email a buyer before anyone reads it. In Day AI, an agent working over the Day AI MCP drafts the email, and a person sends it.