Someone in your team has already connected an AI assistant to a work system, or will this month. Claude and ChatGPT both accept connectors built on the Model Context Protocol (MCP), and once one is connected the assistant can read and change data in that system on the person’s behalf. As the admin, you do not need to stop that. You need to know where the controls are, because they sit in two places: in the assistant’s own workspace settings, and in the business software the assistant connects to. This is a checklist for both.
Two places to control an AI connector
An assistant connector has two ends. The assistant end decides who in your company may add a connector and which of its tools the assistant offers in a conversation. The software end decides what the connection is allowed to do once it reaches your data, who has connected, and how to cut it off. Neither end can do the other’s job. Claude’s workspace settings cannot tell your HR system that a payroll clerk should not change salaries; your HR system cannot stop someone adding an unvetted connector to their Claude account.
So the questions below come in two sets. Ask the first set of your assistant vendor and the second set of every business tool you let assistants into.
At the assistant end: who may add a connector
On Claude’s Team and Enterprise plans, members cannot add a custom connector to the organisation themselves. Anthropic’s help article says only Owners and Primary Owners can add them on Team, and on Enterprise also people with a custom role that includes managing access to libraries. Once an Owner has added a connector, each member still connects to it individually, which the article says means Claude “can only access tools and data that the individual user has access to”. Owners can also remove a connector on the organisation’s behalf, and can disable specific tool calls that render interactive connectors.
On ChatGPT, OpenAI’s guide to adding a custom MCP server says workspace permissions and security restrictions apply to adding and using one, and that write actions require confirmation by default. ChatGPT treats any tool the server has not marked read-only as a write, so a well-built server labels its read tools honestly. Check your own workspace plan and settings for who may add servers: the menus have moved more than once this year.
At the software end: what to ask every vendor
These are the controls that matter once the assistant reaches your data. A vendor that cannot answer them is asking you to trust the assistant’s judgement instead of its own permission checks.
- Does the assistant act as one person? It should sign in through the person’s normal login and inherit exactly their role, not use an integration account that sees everything.
- Can the person narrow what it may do? A consent screen that lists reading separately from changing, tool by tool, where anything can be unticked before approving.
- Are the riskiest actions separate? Changing pay, for example, should be its own permission with its own warning, never bundled into “write access”.
- Can an admin see every connection? Which assistant, which member, what it was allowed, when it was connected and when it was last used.
- Is there an activity log? Each action with the assistant, the outcome and the time, filterable by member.
- Can an admin disconnect anyone’s assistant? Not only their own.
- Is there one switch for the whole organisation? For the day something looks wrong and you need to stop everything before you understand it.
- What can it never do? Some actions should not exist at all: reading stored passwords, deleting records, clocking a person in.
How Orbiz answers the checklist
Orbiz MCP is the connector that lets Claude, ChatGPT and other MCP clients work across the Orbiz tools. Everything an admin needs is on one screen, Settings → Connected AI apps, which every member can open and which shows admins an extra section called Organisation controls.
What each member decides
A connection belongs to one member in one organisation. The consent page names both, and says the assistant can only see and do what you can on the web, in the areas you allow. Connecting sends you to an Orbiz consent page, signed in as yourself. Access is listed tool by tool, reading separate from changing, and you can untick anything before you approve.
In Ledgr, the payroll tool, the assistant has 5 reading actions and 2 that change something. Changing salaries is its own permission with its own warning on the consent page: only tick it if you run payroll.
What an admin sees and does
- All connections. A table of every assistant connected in the organisation: the assistant’s name, the member, the permissions they ticked, the day it was connected, and when it was last used and for what.
- Disconnect anyone’s. Each row has Disconnect behind a confirmation. The assistant loses access immediately; to use it again, the member connects it again from the assistant.
- Organisation activity. An activity log shows each action with the assistant, the outcome — done, not allowed or failed — and the time. You see your own; admins see the organisation’s and can filter by member.
- The organisation switch. An admin can turn AI assistants off for everyone. That stops every assistant and blocks new connections; existing ones work again when the switch goes back on.
What no one can switch on
There is no action for the Vault, none for clocking in or out, and none that deletes anything. An assistant cannot be talked into what does not exist. The Vault, where teams keep shared passwords, is left out on purpose. So is the AMS timer, because an attendance record should describe what a person did, not what their assistant was asked to do.
What Orbiz does not do yet
Being clear about the gaps is part of the checklist. Orbiz has no list of approved assistants: the organisation switch is all or nothing, and while it is on, the member’s own sign-in and consent decide which assistant connects. An admin also cannot set an organisation-wide ceiling on permissions, such as “read-only for everyone”: each member’s role and their own consent ticks decide that. If you need to control which connectors your team uses, do it at the assistant end, where a Claude Team or Enterprise Owner decides which connectors are added, and use Orbiz’s connection list to check who connected what.
A one-hour rollout plan
- Decide which assistant your company uses, and in its workspace settings restrict who may add connectors.
- Add the business-software connectors your team needs, preferring ones where each person signs in as themselves.
- In Orbiz, open Settings → Connected AI apps and confirm the organisation switch is on only when you are ready.
- Tell the payroll team that the salary permission is opt-in, and everyone else that they do not need it.
- A week in, read the organisation activity log with the filter set to each heavy user, and look for “not allowed” outcomes: they show where people expected an assistant to do something their role does not allow.
- Put the organisation switch in your incident runbook, next to resetting passwords.
For the reasoning behind these controls, read what AI assistants should never see in your company. For setup in plain steps, see how to connect Claude or ChatGPT to your business software.
Sources, checked 2026-10-13: Anthropic, “Getting started with custom connectors using remote MCP” (support.claude.com); OpenAI, “Add custom MCP server” (developers.openai.com). Orbiz behaviour is described from the Orbiz web app; the full list of actions is on the Orbiz MCP page.
Built for your industry
