Connecting an AI assistant to your company’s systems is now a few clicks. Claude, ChatGPT and Claude Code all speak the Model Context Protocol, and more business products publish an MCP server every month. The click is easy; the decision behind it is not. An assistant connected to your HR, payroll and project data can be the most useful colleague you have, or the widest door into your most sensitive records. This post sets out six rules we built Orbiz MCP around, so you can hold any vendor to them.
Rule 1: the assistant is a person, not a system
The riskiest setup is an integration account: one key with broad access, shared by whoever configured it. Every request then runs with the integration’s rights, not the asker’s, so an intern’s assistant and the finance director’s assistant see the same data. The safer model is that an assistant always acts as one signed-in person, through that person’s normal login, two-factor check included, and inherits exactly their permissions.
In Orbiz MCP a connection belongs to one member in one organisation. Each request the assistant makes is executed as the real operation the web app would run, through the same permission checks, so there is no second set of rules that could drift from the first. If your role cannot open a payroll screen in the browser, your assistant cannot either.
Rule 2: one token, one place
A token that works anywhere is a token worth stealing. The MCP authorisation specification requires the client to say which server it wants a token for, using OAuth resource indicators, and expects servers to check it. Orbiz binds every token to one organisation’s address: the same token is refused at any other organisation, and it is a random string stored only as a hash, which cannot sign in to the Orbiz web app. Access tokens last an hour; refresh tokens are single-use, and presenting one twice ends the connection, because that is what a stolen copy looks like.
Rule 3: consent narrows, never widens
The consent screen is where a person decides what their assistant may do. It should list capabilities in plain words, grouped by product, and let the person untick anything. Crucially, a consent choice can only remove capability. Ticking a box must never grant something the person’s role does not already allow.
Orbiz shows only the scopes a member could actually use, given their role and the tools their organisation has switched on. One scope is never ticked by default: changing salaries in Ledgr. A payroll manager who wants it ticks it themselves, and even then a direct salary change requires the assistant to send an explicit confirmation. Proposing a revision for review is the gentler path, and it is offered separately.
Rule 4: some data is never on the menu
Least privilege is not only about roles. Some things should be out of reach whatever the role:
- Shared credentials. The Vault has no MCP tools at all. A credential an assistant can read is a credential that can end up in a chat transcript.
- Clocking in and out. Attendance is a record of what a person did, so the AMS timer cannot be started or stopped by an assistant.
- Bank details and identity numbers. Pay tools return gross, allowances and history, never account numbers or tax IDs.
- Contact details in bulk. Looking a colleague up returns a name and an id to assign work to, not an email address.
- Deletion. Nothing can be deleted through the connector. Anything irreversible stays a human action in the app.
- Platform super-admin accounts. They cannot connect at all, because they bypass every organisation’s permissions.
Rule 5: a record of everything, minus the content
When something goes wrong, the first question is what the assistant did. Orbiz records every call with the tool, the outcome (done, not allowed or failed), the assistant’s name and the time, kept for 180 days. It deliberately does not store what was written: descriptions, comments and notes appear only as a length. Members see their own activity in Settings; admins see the whole organisation’s and can filter by person.
Rule 6: switching it off is instant and obvious
A member can disconnect any assistant from Settings on the web or from the mobile app, and it stops working on its next request. Changing or resetting a password disconnects every assistant the person had, because a new password says "I may have been compromised". Leaving the organisation ends the connection too. And an organisation admin has one switch that stops every assistant at once, without deleting anyone’s connections, for the day you need to pause and think.
None of this replaces the platform’s own isolation: each organisation still has its own database and the rest described on our security page. The connector is a second door into the same building, with the same locks. For a broader view of credential hygiene, see how to share team passwords safely; for how roles work in hiring and onboarding, the HRMS workflows page.
Sources, checked 2026-10-04: the Model Context Protocol authorisation specification (modelcontextprotocol.io). Orbiz behaviour is described from the Orbiz MCP implementation; the full list of actions is on the Orbiz MCP page.
Built for your industry
