---
title: AI System Changes CRM Data Despite Model Read Only Restrictions
url: https://www.dataloco.com/en/ai-system-changes-crm-data-despite-model-read-only-restrictions
published: 2026-09-22T15:23:30+00:00
language: en
section: Security
source: https://habr.com/ru/articles/1084190/?utm_campaign=1084190&utm_source=habrahabr&utm_medium=rss
organizations: n8n, DeepSeek, HubSpot
publisher: Dataloco
---

# AI System Changes CRM Data Despite Model Read Only Restrictions

An artificial intelligence agent was unable to write to a customer relationship management system, but the overall system still managed to change the data. This occurred because while the model itself lacked the necessary credentials, the downstream orchestrator retained the ability to perform write operations.

Testing was conducted in a laboratory environment using n8n, DeepSeek, and HubSpot. The setup involved two synthetic deals, LAB-042 and LAB-043. In a control scenario, an initial request referred to one deal, but the structured proposal referred to another. The downstream path executed a PATCH command, which resulted in the CRM being changed for the wrong object.

Findings indicate that the permissions of a model are not the same as the permissions of the entire system. In the first configuration, there was no independent boundary, allowing n8n to use its own HubSpot credentials to execute the change. A subsequent reading confirmed that LAB-042 remained in its original state while the other deal was altered, even though the model had no write credentials.

To address this, a second configuration introduced a deterministic gateway between the model proposal and the HubSpot PATCH action. This gateway checked parameters to determine the allowable consequence before permitting the write operation. In this setup, the expected target was fixed separately from the model generation and used as a verification source.

Under this second architecture, the wrong object proposal for LAB-043 received a deny status. The HubSpot PATCH did not launch, and a new reading confirmed the deal state remained unchanged. This demonstrates that a target mismatch leads to different results depending on whether an independent boundary exists.

The results suggest that describing an agent as read only based solely on the credentials available to the model is insufficient. For production rollouts, security reviews, or procurement questionnaires, it is necessary to identify which component in the execution chain can cause a real consequence and what limits that component immediately before the action. Removing credentials from the model is a useful control, but it does not automatically limit the capabilities of the entire system if downstream components can still change external states.

## This story in other languages

- [Svenska](https://www.dataloco.com/sv/ai-agent-forbjods-att-skriva-i-crm-men-systemet-andrades-anda)
- [Português (Brasil)](https://www.dataloco.com/pt-br/mudancas-na-crm-apesar-de-restricoes-ao-agente-de-ia)
- [Español](https://www.dataloco.com/es/se-prohibio-a-un-agente-de-ia-modificar-crm-pero-crm-aun-cambio)