It usually starts with one number. An owner wants to know who is overdue and by how much, right now, before a call. Today that means logging in, opening the receivables screen, switching to the aging view, and setting a filter for anything past 60 days. Four steps to reach a number the software already knew the whole time.

We spent this year closing that gap. Not with a new dashboard, and not with a chatbot bolted onto the login page. We connected the software to the AI assistant people already use, and let them ask in plain English. This post is about how that works, and about the one design decision we are most proud of.

The fix everyone else sells

The common way to put AI near business data is to move the data to the AI. You export your books, or point a sync at your database, and a vendor loads it into their cloud so their model can read it. It demos well. It is also the part that should make you nervous.

Once your financials are a copy on someone else's disk, three things are true at once. The copy is only as fresh as the last sync, so the answer you get is quietly stale. The copy is now a second place your data can leak from. And you have taken on faith a promise about how that copy is stored, retained, and trained on, usually in a paragraph you did not write.

We did not want to ship that. So we did the opposite.

What we did instead

Instead of moving your data to the AI, we hand the AI a door into the running system. Same records, same permissions, live. It asks questions through that door and reads the answer in the moment, from your server. Nothing is exported, nothing is synced, and nothing is stored somewhere else.

The door is built on MCP, the Model Context Protocol. It is an open standard for connecting AI assistants to real systems: the software offers a set of tools, and an AI app connects and uses them. It is not ours, it is not proprietary, and it ships built into the product. There is nothing to buy and no third party sitting in the middle of the conversation.

The part people screenshot

Here is the actual thing, with the customer name changed.

You: Who owes me money and has not paid in 60 days?

Assistant: Three customers are past 60 days, $18,240 in total. The largest is Northwind Fabrication at $12,400 on invoice #1042, 71 days out. Then Harbor Foods at $3,180, and Cedar Line at $2,660. Want me to draft reminder emails for all three?

That answer came from live invoices, not a snapshot. The follow-up ("draft the reminders") is where it gets useful, and it is also where the design decision below starts to matter, because now the AI wants to do something, not just read.

It borrows your badge. It never gets its own.

The easy way to build all of this is to give the AI its own account with the keys to everything. That is how integrations get shipped on a deadline, and it is also how they turn into the breach in the incident report. We refused to do it, and it is the decision the rest of the design hangs on.

A connection key is bound to a real person's membership in the workspace. When the AI acts, it acts as that person, and every permission check the system already runs for them runs, unchanged, for the AI. That single choice gives you the rest for free:

It can never see more than its owner can. Ticking rooms when you create a key only narrows what it reaches. A key cannot hand out access its owner does not already have.
It is read-only by default. Reading is the whole job for most people. Writing is a separate, deliberate switch.
Even with write access, it cannot act alone. Every change lands in a review queue with a plain-English summary, and a human presses Approve or Reject before anything is saved. The reminder emails above do not send themselves.
Every request is logged, including the refused ones and the reason why. "What has the AI been doing?" is a question with a real answer.
Revoking is instant. Delete the key, or remove that person from the workspace, and it stops working immediately.

And the whole feature ships off. One setting turns it on, and with no key there is no entry. Nothing is listening until you decide it should be.

What we will not claim yet

Claude Code, Claude Desktop, and Cursor all connect today, along with anything else that speaks MCP over HTTP. ChatGPT does not, and we would rather tell you why than paper over it.

ChatGPT's custom connectors expect an OAuth sign-in or no authentication at all. They cannot carry a scoped access key the way Claude and Cursor do. Supporting it properly means this software also becoming an OAuth provider, which is real work that is on the roadmap and is not built yet. The alternative, telling you to expose your business data with no lock on the door, is not a trade we are willing to offer. So for now, the honest answer is: not ChatGPT, not yet.

The point

The software already knew who owed you money. It knew which deals went quiet and what shipped last week. The only thing missing was a way to ask that did not involve remembering which screen it lived on. Now there is one, and it runs on your server, under your permissions, with a human still holding the pen on anything that changes.

If you want to see the whole thing, the AI connections page walks through setup and every guardrail in detail. If you would rather just talk to a person about your own setup, tell us what you run and a specialist will follow up within one business day.

We taught an ERP to answer questions. Here is what that actually looks like.