Your AMS or CRM Permissions Just Became Your AI Policy

On September 22, Relevate announced an MCP server for its association and MLS platform. In plain terms, authorized users can now ask Claude or ChatGPT questions about live, permissioned member data, without exporting anything first.¹ A few days earlier, GrowthZone said a read-only reporting connector of its own is in development.² Those are association platforms, but I'd be surprised if donor CRMs are far behind. Association, charity or foundation, this is coming to the system that holds your people.

My first reaction was concern, and I think it's the right one. Not about the technology. I build and run MCP servers myself, a lot of them, and I love what they make possible. My concern is about data governance and privacy, and about how few organizations have looked at the permissions this kind of connection will inherit.

What MCP actually is

The Model Context Protocol is an open standard Anthropic introduced in November 2024 for connecting AI assistants to the systems where your data lives.³ By December 2025, when Anthropic handed it to a new Linux Foundation fund, it said ChatGPT, Gemini and Microsoft Copilot had adopted it too.⁴ Instead of someone exporting a spreadsheet into a chat window, the assistant calls your system directly and works with live data.

Here's the part that matters. The MCP specification says plainly that the protocol itself cannot enforce security; consent, access controls and data protection are left to whoever builds and configures the connection.⁵ Servers must implement proper access controls, and the AI client should log tool calls and keep a human able to say no.⁶ "Should" is doing a lot of work in that sentence.

So "it's MCP" tells you almost nothing about whether it's safe. That is decided by the vendor's implementation and your own permission setup.

The questions I'd ask before connecting anything

Whose AI is on the other end? Is the assistant an enterprise account your organization pays for and manages, or a staff member's personal subscription? Anthropic's consumer terms, for example, allow Free, Pro and Max conversations to be used for model training when the user has that setting on, and those terms do not apply to its commercial plans.⁷ The same member or donor record can end up under two very different sets of rules depending on which login asked for it. And in NTEN and Bridgespan's 2026 survey of 917 nonprofit staff and executives, 53% reported using AI in informal or unsanctioned ways, so assume someone will try the personal route.⁸

What can it do: read, or write? Read-only is a very different conversation from an agent that can update records, send emails, change a membership status or log a gift. Know which one you're turning on.

What can't it see? Which tables and fields are off-limits? For an association that might be payment details, accommodation or health notes, and disciplinary records. For a nonprofit, add giving history and wealth-screening notes, and, if you deliver services, anything in a client or case record. If the answer is "whatever the user can see", then your role design is now your data policy.

Who does it run as, and where is the log? If the connection runs under a shared admin account, every AI query looks like that admin did it. The MCP security guidance warns about exactly this: when identity isn't handled properly, the logs show a different identity and investigating an incident gets much harder.⁹

What happens when it goes wrong? Every MCP server I run has a fallback: a way to revert, a way to recover, and a clear list of what it may and may not do, with anything on the "may not" list needing a human to approve it. This is new territory, including for the vendors. In June 2025 Asana took its MCP server offline after finding a bug that could have exposed some customers' data to other users of the same server.¹⁰ In May 2025 researchers showed that a malicious public GitHub issue could steer an AI agent using GitHub's MCP server into leaking private repository data.¹¹ Neither is a reason to avoid MCP. Both are reasons to have a plan.

The permissions problem nobody has looked at

In the associations and nonprofits I've worked with, user roles in the AMS or CRM are managed by the system admin or by IT. Sometimes they aren't really managed at all. They were set up years ago by the vendor or an implementation consultant and have stayed at the defaults ever since. That was survivable when a person had to click around. It isn't when an assistant can query everything a role allows, in seconds.

So before an MCP connection runs anything, do a permission health check: who has which role, what each role can actually reach, which accounts are shared, and which belong to people who left long ago.

Start it like a new guest, not a new admin

Connecting Claude to your AMS or CRM through MCP is like giving a guest your admin access. You wouldn't do that on day one. You'd let them look around first, see how they work, and hand over more as you understand what they can do. It won't take as long as onboarding new staff, but it takes the same discipline:

1. Review your roles and permissions. The health check above, before anything connects.
2. Decide what you want it to do. Write down the goals and your guidelines. "Answer renewal questions for the membership team" is a goal. "Connect the AI" is not.
3. Give it its own restricted user. Read-only, a narrow slice of data, logging on, one named owner. The MCP spec's own security guidance recommends the same shape for scopes: least privilege, starting with low-risk reads.¹²
4. Let it earn more. Start with audits, reporting and data-health checks. Expand what it can see and do as it proves itself, and keep a human approval step on anything that writes.

Quick takes

Governance is behind use, not absent. In the same NTEN and Bridgespan survey, 40% of nonprofit executives said rules on what data can and cannot go into AI tools were fully in place, with 33% still developing them.⁸ If you're in that second group, add "which systems may an AI connect to, under whose account" to the rules you're writing.

This builds on a problem you may already have. Earlier this week I wrote about software you already own quietly training on member data. MCP is the other door: not the vendor's AI reaching in, but yours. Both come down to knowing which settings are on.

Worth a read

MCP Security Best Practices (Model Context Protocol). Written for developers, but the scope-minimization section gives you the vocabulary for the vendor conversation.

2026 State of Nonprofit AI (NTEN and The Bridgespan Group). The best current picture of how far AI use has run ahead of policy in the sector. It is a network sample, not a census, so read it as direction rather than precision.

The honest state of things: the MCP work I've done for small associations and nonprofits recently has mostly connected isolated data stacks, things like analytics and reporting tools, rather than the AMS or CRM itself. For the organizations I talk to, a live connection to the core system is still theoretical. That's good news, honestly. It means you have time to do the boring part first.

MCP is easy to connect and only medium-hard to configure well. The difference between the two is where your members' and donors' data lives.

---

From the Mind of Ravi Rooprai is a weekly column on association tech, data, and AI. Read the perspectives for the longer arguments behind it.

Researched with AI assistance and fact-checked against primary sources. The analysis, judgment, and writing are mine. How this column is made →