Don't add the payroll connector to the chat that reads your email

The move everyone makes

A new connector shows up. Payroll this week, your bank or accounting software next. You open the assistant you use every day, the one already connected to your email, your shared drive and the web, and you add it there. It's one click, and now you can ask about invoices, payroll and next week's meetings in the same chat.

That's the wrong first move. The risk isn't the payroll connector. It's everything else sitting in the same conversation.

Gusto said it plainly when it launched its AI connectors for Claude, ChatGPT and Slack on October 22, 2026. Its setup guidance begins: "Do not connect other MCP servers to the same client session." It also asks you to use trusted clients, keep manual confirmation on, check outputs and opt out of model training where you can. That's a payroll company telling customers how to use its own product. The advice applies to any connector that touches money or personal data.

Why it goes wrong

An AI assistant can't reliably tell the difference between your instructions and text it happens to read. That's the root of what security people call prompt injection.

Here's an illustrative example. Your everyday assistant reads your inbox to write a morning summary. One email, from someone you've never heard of, contains a line of text written for an AI rather than a person, asking the assistant to look up employee bank details and send them somewhere. On its own, an email assistant with no payroll access can't do much with that. Put payroll in the same session and the instruction now has something to reach for.

It doesn't take a clever attacker either. A web page the assistant opens while researching a supplier, a shared document from a client, a calendar invite. Each is text written by someone else that lands in the same conversation as your most sensitive tools.

The risk grows with the newer assistants that work in the background. Several now check your email and calendar every few hours and get work ready before you ask. That's useful, and it also means outside text arrives in the session while you're not watching. The more an assistant reads on its own, the more it matters what else it can reach.

Confirmation prompts help, but they're not a full answer. They depend on you noticing that a request looks wrong, at the end of a long day, on the fifteenth prompt.

The better first move

Give each sensitive system its own room.

One project, chat or account per sensitive system. Payroll in one, banking in another, accounting in a third if you use it heavily. If your assistant lets you limit connectors per project, use that. If it doesn't, use a separate account or browser profile for sensitive work.

Nothing that reads outside text in those rooms. No email, no web browsing, no shared drives with documents from other people. The payroll room talks to payroll.

Manual confirmation on. Turn off any setting that lets the assistant run tools without asking. Read each action before you approve it.

You carry information across. If you need something from email in the payroll room, like a new hire's start date, copy it over yourself. That small manual step is the boundary doing its job.

Least data, revocable access. When a connector lets you pick data categories, choose the minimum. Know where the revoke button is.

Yes, this is less convenient. You'll switch between two chats, and you'll occasionally retype a date or a name. That friction is small next to explaining to an employee why their bank details left the building. Most owners find the payroll room gets used a few times a pay period, which is a small price for the separation.

We've written about this idea before as a general rule for agents: check what a tool is allowed to read before you trust what it does. Our note on the tool context trust gate covers the broader version.

When combining is fine

Not every connector needs its own room. The question is what could go wrong if something the assistant reads told it to misbehave.

Read-only tools with nothing sensitive can sit together. A calendar, a public product catalog and your note-taking app in one chat is fine.

Low-stakes tools that only produce drafts are fine too. An assistant that drafts emails you send yourself can read your inbox all day.

Accountants and bookkeepers who serve many clients should be stricter still. A session that holds several clients' payroll or ledgers should never read outside email or documents, because a mistake there crosses from one client's data into another's.

The line is when a session can both read outside text and take actions involving money, payroll, customer data or personal records. That combination is the one to split.

What to tell your team

If more than one person uses AI assistants at your business, make this a written house rule, because people will connect things on their own.

Keep it short. Sensitive connectors, which you should name, go in their own project or account. Nobody adds them to a general assistant. Automatic tool use stays off for those connectors. Anyone who connects a new tool that touches money or personal data tells you first.

Then check it once a month. Open each person's connected apps list and look for payroll, bank or accounting connectors in the wrong place. Do the same when someone leaves: their assistant's connections should go when their logins do. It takes a few minutes, and it's the kind of thing nobody notices until it matters.

Put this into practice

Today, open your AI assistant and list everything connected to it. If anything touches money, payroll or personal records, move it to its own project or account, and disconnect it from the general one. Turn off automatic tool use there. Set a reminder for the first of next month to look again.

If you're building internal assistants or agent workflows and want sensitive tools separated properly by design, rather than by habit, that's what our AI applications and agents team builds. Talk to us.

Related work: Spin Market.