The need
The organisations in these projects already had the information they wanted to ask about. It sat in operations databases, a sales CRM, a photo library, staff time records and a vendor's web platform. People wanted to ask questions of it in plain language through AI assistants.
They also needed to decide who could see what, keep database passwords off people's laptops, and make sure an assistant could change records only in ways they had agreed.
How we build the connection
We build MCP (Model Context Protocol) servers. These are connectors that give compatible AI assistants, including Codex, ChatGPT and Google Antigravity, controlled access to approved business data. The details differ by project. These rules apply to every connector on this page:
- Individual sign-in: People sign in with their own account, in most projects their organisation's Google account. Database credentials stay on the server.
- Access by person: The server knows who is asking and checks what that person may do on every request. Some connectors go further and grant access by data area or by tool.
- Read-only by default: Database queries run read-only, on a read-only account or inside a read-only transaction, with limits on query time and the number of rows returned. Where an assistant can change records, it is limited to specific actions that the server checks before anything is saved.
- A guide for the assistant: Each connector includes written guidance on the data, so the assistant uses the right tables and definitions.
The projects at a glance
| Organisation | Data connected | What the assistant can do | Status |
|---|---|---|---|
| An international school | Photo library, staff time records, calendars and alumni records | Read and search, within granted data areas | In production |
| A waste-processing and haulage operator | Jobs, loads, tickets, documents and photos | Read and report; save draft dispatch plans | Production pilot |
| A lead-generation operator | Campaigns, calls and leads | Read and report | In production |
| An education-products company | Sales CRM accounts, emails and pipeline | Read; make previewed, confirmed changes | In production |
| LevelHeads (our own operations) | Projects, tasks, CRM, calendars, documents and wiki | Read; make previewed or approved changes | In production |
An international school
Staff in the school's advancement team wanted to use AI assistants to find photographs, check staff time records and calendars, and look up alumni records. Several of these sources came from our earlier work for the school: a photo library with AI-written captions and search by meaning, a staff timecard system, and an alumni database refreshed each night from the student information system.
- One connection, four areas: A single connector for Codex and Google Antigravity covers photos, time records, calendars and alumni records. Each area is granted to each person separately, and alumni records stay hidden unless granted.
- Questions checked before they run: The assistant can write its own database queries. Each one is checked against an approved list of tables and columns, then runs on a read-only login inside a read-only transaction, with limits on time and rows.
- Photos in the conversation: Staff search the photo library by meaning and see previews inside their AI assistant.
- A record of every request: Each call is logged with who made it and how many rows it returned. Query text and results are never stored. If the log can't be written, the request is refused.
- A front door with no database access: The public sign-in service holds no database access of its own. It passes approved requests to a private service.
The connector is in production.
A waste-processing and haulage operator
The operator's jobs, weighbridge tickets, photos and delivery documents are kept in a vendor's web platform. Staff wanted to ask about jobs, tonnage and paperwork. The logistics coordinator wanted help turning the next day's truck plan, until then passed on verbally and written in an office diary, into a schedule.
- A checked copy of the data: A scheduled capture reads records and files from the platform every hour through the working day and copies them into a private database and file store. It never writes to the platform. Each file is checked against a checksum, and a daily check sends an alert if any data is more than 24 hours old.
- One connection, two sets of tools: Read-only reporting tools cover jobs, loads, tonnage, documents and photos. Dispatch tools match spoken truck, site and customer names against current records and save draft plans for the coordinator.
- Access tool by tool: Each person is granted specific tools. Reporting uses its own read-only database account, and permanent deletion is switched off.
- Logged before it runs: Every call is logged before it runs. If the log can't be written, the call doesn't run.
- Files without share links: Documents and photos download through the connector in small parts, with permission checked for each part. There are no links that someone could forward.
The connector is running as a production pilot with Codex.
A lead-generation operator
The company runs its calling and lead-generation work from its main operations database. It wanted to ask an AI assistant about campaigns, calls and leads without giving anyone a database password.
- Company sign-in: People sign in with company Google accounts and must also be on an approved list. If someone's access is removed, their session ends at their next request.
- Read-only, enforced four ways: A read-only database login, read-only transactions, a check that accepts only a single read query, and limits on time and rows.
- A reporting guide: A curated set of reporting views, query patterns and definitions helps the assistant use the data correctly, and marks fields that need care, such as contact details.
- Staging before production: Staging and production run in separate cloud accounts, so changes can be tested before they reach the live connection.
The connector is in production with Codex.
An education-products company
The sales team wanted to work its CRM through an AI assistant: look up accounts and their emails, record what was sent and move deals through the pipeline.
- Their own accounts only: Salespeople sign in with company Google accounts and see only the accounts assigned to them. A small group of managers can run wider read-only queries.
- Preview, then confirm: Every change is shown as a preview first. It is saved only after a confirmation that matches the preview exactly, in a single transaction that records who made it. A repeated request can't apply the same change twice.
- History kept: Corrections and removals keep the earlier record, so the pipeline history stays complete.
- No sending: The connector has no way to send email. Salespeople send their own messages, and the assistant records what was sent.
The hosted connector is in production with Codex.
Our own operations
We use the same approach in our own business. HeadsUp, our project-management and CRM software, is connected to Codex together with our calendars, documents and internal wiki.
- Changes need a preview: Project and task changes need a preview and a confirmation that expires after five minutes. Calendar changes default to a trial run, and wiki edits are refused unless the text being replaced is found exactly as expected.
- Approval outside the chat: Our newest gateway connects ChatGPT and Codex to email, documents and project records. Its riskiest actions, such as deleting files or calendar events, wait until a person approves the exact action outside the chat.
Both connections are in production for our own team.
Why it mattered
Each organisation can now ask questions of its own records through an AI assistant and still decides who sees what. The access rules and limits sit in the connector itself, so they apply the same way whichever assistant a person uses.
Sources: LevelHeads project code, deployment records and test results, reviewed in October 2026. This page describes what was built and how access is controlled. It does not report usage or time saved. Clients anonymised: system names, locations and figures that could identify them are left out.