How AI Should Connect Business Data and Systems Without Losing Control

Most AI projects in Greater Vancouver offices do not fail because the model is weak. They fail because the model is asked to invent a process the business never wrote down, using data nobody classified, through a connector nobody owns. We covered the workflow side in the AI workflow field guide. This article is the systems side: how the tool is allowed to reach email, files, accounting, warehouse software, and the rest of the stack.

If identity, backups, and vendors are still unnamed, stop here and read what a managed IT provider should own. An AI connector on top of an undocumented tenant is how a helpful summary becomes a public file.

The system of record stays the system of record

AI should not become a second accounting package, a second EMR, or a second inventory database. It should read from the system of record, propose or execute a narrow action, and write back only through an approved path. When staff start treating the chat history as the file of record, you have split the business across a product that does not do restores the way backup does.

That is why we start with the business impact, identify the root cause, implement the right solution, and document what comes next. The “right solution” is often a connector with three permissions, not a new platform with forty.

Four connection patterns that actually hold up

1. Identity-bound assistants (Microsoft 365 Copilot and similar)

These tools see what the signed-in person can already see. That is the feature and the hazard. If a Coquitlam firm's SharePoint has a decade of unrestricted folders, Copilot will summarise them for anyone who asks nicely. The integration work is not “turning Copilot on.” It is labels, groups, guest cleanup, and a decision about which sites are in scope. Microsoft 365 support is the plumbing. Copilot is a flashlight.

2. Workflow automation with human checkpoints

Power Automate, Logic Apps, and similar tools should move a defined object: an email to a list, a PDF to a folder, a Teams alert to a supervisor. The connection uses a service account or managed identity with only those rights. Shadow mode first: the flow proposes, a person confirms. That sequence is in where to start with AI. Skip it and you will debug a loop that files the same invoice twelve times on a Sunday.

3. Line-of-business APIs

Warehouse WMS, legal practice systems, clinic EMR, and accounting platforms should be reached through their documented API or an approved middleware, never by scraping a desktop session. The service account must not be the same admin a technician uses for server work. Write the allowed verbs: read orders, create a ticket, never delete a patient, never push a payment. For clinic-specific privacy constraints in BC, start with AI for medical clinics and PIPA rather than a generic chatbot vendor.

4. Retrieval over a bounded corpus

If the goal is “ask our policies,” give the model a bounded set: current SOPs, not every email since 2018. Retrieval-augmented generation is still a data project. Someone has to own freshness, access, and what happens when a policy is withdrawn. A vector store with no owner is a wiki that cannot be audited.

Least privilege is the integration spec

Write the permission list before you buy the tool:

• Which mailboxes, sites, lists, or tables?
• Read, write, or both?
• Which identities: user-delegated, service account, or managed identity?
• Where are secrets stored, and who can rotate them?
• What is logged, and who reviews the log?
• How do we disable the connector in fifteen minutes?

If the vendor needs Global Admin to “just connect,” that is a buying decision, not a technical necessity. Many products ask for it because it is easier for their onboarding team. It is not easier for you when that token still works after the project is cancelled.

Data residency, logs, and the copy you did not know you made

A prompt is data. So is the file the model retrieved, the vendor's training opt-out setting, and the support ticket you filed with a screenshot of a customer record. Map three places: where the source lives, where the model runs, and where the vendor stores logs. Microsoft 365 residency is not inherited by a third-party agent that copies the same document into its own cloud.

For cost, the same map prevents silent spend: retries, oversized context, and premium models on filing tasks. That failure mode is documented in runaway OpenAI and Azure costs. A connector without a budget owner will find a credit card.

What usually breaks first

If the rollout already feels broken, use why Copilot and chatbot rollouts fail as the diagnostic. The model is rarely the first thing to replace.

A connection sequence that fits a 12 to 80 person company

1. Name the workflow and the system of record. Intake, invoicing, scheduling, or exceptions. Not “we need AI.”
2. Confirm identity and data hygiene. MFA, least privilege, and a folder structure a flashlight can safely illuminate.
3. Choose the narrowest connector. User-bound assistant, workflow tool, or API. One, not three.
4. Run shadow mode. People still do the action. The tool proposes. Measure error rate before write access.
5. Log, budget, and write the off switch. Then, and only then, let it write back.

Warehouse floor examples of this discipline are in AI on the warehouse floor: exception alerts and shift reports from data you already have, not a robot that needs a greenfield network.

Microsoft 365 is usually the first pipe, not the last

For most Greater Vancouver SMBs the first honest connection is already sitting in the tenant: Exchange, SharePoint, Teams, and the Power Platform. That is cheaper and easier to govern than a new agent vendor. It is also where oversharing shows up first. A Richmond professional firm that drops every matter folder into a company-wide library will get Copilot answers that look brilliant and are a confidentiality incident.

Treat Graph permissions like firewall rules. If a connector asks for Mail.ReadWrite across the organization when the workflow only files invoices from one mailbox, the answer is no. If a Copilot Studio agent needs to post in one Team, it does not need Sites.FullControl. Write the exception the same way we write a firewall change: who asked, what it can do, when it expires.

Third-party tools still have a place when the system of record is not Microsoft: a WMS, an EMR, a legal practice system, a custom SQL app. Then the pattern is API plus a company-owned secret, not a browser extension running on a warehouse PC. Browser extensions and personal API keys are how connections disappear when a contractor turns in a laptop.

A Greater Vancouver example, without the theatre

A 35-person distributor in Surrey wants “AI that tells us which orders are late.” The system of record is the WMS. Email is where customers complain. Spreadsheets are where supervisors currently live. The useful connection is not a chatbot that guesses from the spreadsheet. It is a read of open orders, a match against promised dates, and a Teams message to the named supervisor for exceptions over a threshold. Shadow mode for two weeks. Then, if the exception list matches reality, write a flag back to the WMS or a tracked list. No new warehouse network. No model that “learns the business” by ingesting every customer email.

A downtown Vancouver legal practice has a different first connection: matter files are the system of record, and Copilot should not see every matter. The work is labels, client-matter security, and a bounded corpus of templates. The AI that writes a first draft of a routine letter is useful. The AI that can retrieve another client’s file because a folder was never restricted is not a feature.

Who owns the connector

Same rule as managed IT. The company owns the tenant, the vendor contract, and the secrets. The operator, internal or NYRO, documents permissions, logs, and disable steps. Our AI and automation service is scoped that way: observe the work, connect the smallest surface, keep people in control. We do not sell a model. We sell a connection that can be explained to an auditor, a bookkeeper, and the person who has to turn it off at 6 p.m. on a Friday.

If you need hands on a live incident instead of a design session, get IT help. If you want the connection designed before anyone pastes another spreadsheet into a chatbot, book a free assessment or call (778) 775-4535.

Contextual next steps

This guide sits in our AI and automation cluster. Review AI for business, then the workflow field guide and where to start with AI. Identity and tenant ownership still come first; use what a managed IT provider should own and Microsoft 365 support. For a scoped build, contact the team or start with a free assessment.