Connectors in one minute
A connector is a route to another system. It might let an assistant find an invoice in a folder or inspect a customer's current order. The route has an account, permissions and technical limits. Knowing that the connection exists is not enough; you need to know what it can actually read or change.
Connectors provide a specific route to data and actions
- AI application
Interprets the task and requests an available operation.
- Connector
Maps that request to an authenticated service operation.
- External service
Returns permitted data or reports the result of a change.
Suppose a sales team asks for open quotations from its CRM. The connector needs to query the correct account, understand which status means 'open' and return the relevant fields. The model can then help explain the results. A general understanding of sales terminology cannot replace this actual connection or establish the current state of a customer's quotation.
The word connector is broad. Some integrations search an indexed copy of documents; others make live API requests. Some expose actions, while others mainly retrieve data. Microsoft's connector documentation, for example, describes actions and triggers for supported services. That is one product's integration model, not a promise that every AI connector includes scheduling, writes or event notifications.
A connector may use MCP to expose capabilities through a common protocol. It can also use a direct API or another supported interface. MCP names a communication protocol; connector names the integration more generally. Neither term alone tells you whether the application can access a particular folder or update a specific field.
Reading, writing and freshness change the task
| System | Possible read operation | Possible write operation |
|---|---|---|
| Gmail | Find messages or retrieve an attachment. | Create a draft or send a message, if supported and authorised. |
| Drive | Retrieve a document from an allowed location. | Save or update a file. |
| CRM | Read contact or quotation records. | Create a note or update a record. |
| ERP | Inspect product or order information. | Change an allowed business record. |
| Database | Run a permitted query. | Apply a scoped update. |
Read and write should be distinguished, but real permission scopes do not always map neatly to everyday labels. Gmail's official API scope documentation shows that some scopes bundle several operations; a compose-related scope can include sending as well as managing drafts. An application that promises draft-only behaviour must enforce that behaviour rather than assuming the account scope necessarily does.
Authentication establishes the identity used by the integration. OAuth can let an application obtain scoped access without asking the model to handle a password. Other systems use different supported mechanisms. An administrator may also need to allow the integration. None of these steps should be confused with a guarantee that the requested business record exists or is visible to that account.
For invoice analysis, the relevant scope might be one approved folder plus a separate destination for the output table. The workflow can read invoices, extract fields and prepare a traceable report. It does not need permission to delete the source files or send messages to every supplier. Restricting the exposed operations makes accidental changes less likely and the task easier to review.
Freshness matters just as much as access. A search index updated overnight may be suitable for a policy manual but inadequate for a live stock promise. A connector can accurately return yesterday's indexed record while the source has already changed. Establish whether the result comes from a live query, a cached response or an index, and include a relevant time or version when it affects the answer.
An empty result also needs interpretation. There may be no matching document, but the account may lack access, a filter may be wrong or additional result pages may remain unread. A failed request is another possibility. Report these conditions distinctly instead of presenting every absence as proof that the underlying record does not exist.
RAG can use connector results as retrieved context for generation. The connector supplies a route to information; the retrieval process selects what is relevant, and the model produces an answer. A good connection cannot compensate for selecting the wrong document or misreading its contents. Each stage needs an appropriate quality check.
Manage permissions, changes and the data path
Match access to the required operation. A request to compare records should normally use reading capabilities. If a later step requires a change, make the target, old value and proposed value explicit. Technical permission to write does not automatically authorise every write the model could formulate.
Privacy is not a single property of the connector's name. Consider the whole path: the source service, integration, AI application, model provider and any stored logs or indexes. Which fields are transferred? Where are they retained? Which users can retrieve the resulting information later? A narrow source selection is often more useful than copying entire records just because an API can return them.
Access controls must also apply when information is reused. A search index or memory store should not reveal a document to a user who could not access the original. AI Memory can preserve task progress, but should not silently turn one customer's information into shared context for another. Separate identities and workspaces where the use case requires it.
Writing introduces questions about concurrent changes. A colleague may edit the record after the AI prepared its proposal. Before applying an update, compare the relevant source version or current values. Where Human-in-the-loop is required, approval should refer to the concrete proposal that will actually be executed, not to an earlier summary of a different state.
- Identify the connected account and exposed operations.
- Check source permissions and result completeness.
- Distinguish live information from indexed or cached data.
- Separate proposed changes from completed writes.
- Record meaningful outcomes without copying unnecessary sensitive contents.
Disconnecting an account prevents or limits future access according to the integration's design; it does not necessarily erase already retrieved copies, indexes or logs. Retention and deletion need their own controls. AI Agents and Tool Use become more useful when these boundaries are explicit, because the system can explain what it accessed, what it changed and what remains unresolved.