Skip to main content
API and MCP

Managing Hanna CRM Access and Tools in ChatGPT

Manage workspace access, Hanna permissions, tool selection, refreshes, and least-privilege controls.

Last updated 12 days ago

Use this guide to decide who can access the Hanna CRM plugin, which tools should be enabled, and how to maintain least-privilege access across ChatGPT and Hanna.

Two access layers

ChatGPT plugin availability and Hanna data permissions are separate controls:

  • the ChatGPT workspace determines who can install or use the plugin and which tools are enabled;
  • Hanna determines which modules, records, fields, and actions are available to the signed-in user.

Connecting ChatGPT does not grant Hanna administrator access. Each MCP request runs in the context of the authenticated Hanna user and remains subject to their role and account configuration.

Personal or workspace plugin

A personal plugin is suitable for controlled testing or one user. It is owned and managed by the account that created it when ChatGPT permits personal plugin creation.

A workspace plugin is suitable when an organisation wants centralised availability and tool controls. Publishing and management permissions depend on the ChatGPT workspace role and policy. Enterprise and Edu workspaces may provide additional group and role controls.

Even with a workspace plugin, do not create a single shared Hanna connection for all employees unless an approved technical requirement demands it. The recommended model is:

ChatGPT user → their Hanna OAuth connection → their Hanna permissions

When these controls are available in your ChatGPT administration interface:

  • make the plugin available only to workspace members who need it;
  • begin with search and read tools;
  • apply your organisation's approved permission mode to low-risk tools;
  • review new write or modify tools before enabling them;
  • keep delete, bulk update, user, or permission administration tools disabled unless required;
  • do not expose the plugin to public site visitors without a separately approved use case.

OpenAI states that write actions require user confirmation by default. This adds protection, but it does not replace Hanna permissions, clear tool descriptions, or the administrator's decision about which actions should be enabled.

Review and refresh tools

  1. Open the Hanna CRM plugin details or settings page.
  2. Review each tool's name, description, and whether it reads, creates, updates, or deletes data.
  3. Disable actions that the organisation does not want ChatGPT to perform.
  4. After Hanna adds MCP tools, select Refresh tools, Refresh actions, or the equivalent action shown in your interface.
  5. Review the purpose and risk of new or changed tools before enabling them.
  6. After a change, run one read test and one controlled write test with a test record.

OpenAI documentation states that individual tools can be toggled and refreshed from the plugin settings. A Hanna MCP update may therefore not appear until you refresh the plugin's tool definitions.

Check the Hanna account

Before granting access:

  1. Confirm that the Hanna user is active.
  2. Review the user's role, module permissions, and field visibility.
  3. Grant API and MCP access only to users who need it.
  4. Do not grant write or delete permissions solely because the user is connecting ChatGPT.
  5. When duties change or the user leaves, disable the account or adjust permissions and review the ChatGPT connection.

Periodic review

Review periodically:

  • who can use the Hanna CRM plugin;
  • which Hanna accounts are connected;
  • whether unnecessary administrator or write permissions remain;
  • whether new MCP tools have appeared;
  • whether tool actions and descriptions still match approved business processes.

Was this helpful?

Still need help? Ask the team