Review HVAC CRM permissions before connecting an AI assistant

Write an action inventory before the demo

Choose one intended task, such as summarizing pending quote questions for an account owner. List the information it needs and the actions it does not need. Reading a quote, changing its price, creating a customer and sending an email are separate permissions even when a vendor presents them in one conversational interface.

Create a worksheet with action, data category, allowed account or location scope, approving person and expected evidence of the action. Include customer-facing messages, record deletion, bulk exports and changes to billing details as explicit rows. Mark unverified capabilities unknown. A general statement that the tool integrates with your CRM does not establish its actual authority in your account.

Have the administrator verify the effective boundary

Ask the administrator and vendor to demonstrate the exact account permissions, action approvals and disconnect process that apply to your configuration. Confirm how the connection behaves when a user lacks access, when multiple locations share a parent customer, and when an assistant requests a write action after a read-only task. Do not assume that conversational instructions replace platform permissions.

For a fictional pilot, the assistant might need approved opportunity notes but no billing records. If the product cannot enforce that boundary, the team can choose a manual, minimized export or defer the connection. Do not create broad access simply to finish a demonstration. The business owner should understand which data the provider receives before authorizing a connection.

Test removal and review responsibility

Use an approved test environment or fictional records where available. Check what happens when access is revoked and who reviews activity afterward. Record the connection owner, approved use, review date and the steps to stop it. Avoid leaving an experimental integration attached to a staff account with no operational owner.

The first pilot should answer a bounded question without changing records or contacting customers. Compare its answer with the source and check that unrelated information did not become part of the output. Only consider additional actions after the team can describe their controls and approval steps. This is a decision checklist; it does not authorize a connection or substitute for an administrator’s security assessment.

Before you use the result

• Separate read, write, send, export and delete actions.
• Verify actual account scope and customer/location boundaries.
• Check provider data handling before approving production use.
• Name a connection owner and a practical disconnect procedure.
• Use a minimized manual packet if permissions cannot meet the intended scope.

What the sources support

Jobber’s Claude announcement describes both business-data questions and record-changing actions; it does not establish every account’s permissions. NIST discusses privacy and cybersecurity considerations in AI. The worksheet is our proposed review procedure, not a security certification or hands-on integration test.