What an AI assistant should never do without the owner's approval
Sort every task your AI assistant could do into three groups. Reads, like a rent roll or a list of late tenants, can run on their own. Changes, like logging a repair, should show a draft and wait for your yes. Money, legal notices, signatures and decisions about applicants should wait for your own tap, made outside the chat, and the assistant should never be able to approve them for you. Keep tenant SSNs and bank numbers out of any chat.
Three groups of tasks
| Group | Examples | Rule |
|---|---|---|
| Reads | Rent roll, who owes rent, lease end dates, a unit's ledger | Fine to run on its own. Check the numbers you act on. |
| Changes | Log a repair, add a property, update a note | Show a draft, then act only on your yes. |
| Money and legal | Paying a bill, waiving a charge, a late fee rule, sending a lease or a notice, a refund | Waits for your own approval outside the chat. |
| People decisions | Approving or denying an applicant, choosing whom to evict | You decide, with one written rule for everyone. |
The protocol does not draw these lines for you. MCP only standardizes how an AI app talks to outside systems, and its architecture page defines a tool as a function the AI can invoke to take an action. Where the line sits is a design choice by the software behind the connector, so it is worth checking before you connect.
Why a chat is a poor place to approve money
- A chat can be steered by text it reads. If an assistant reads a tenant email that says "approve this payment", the instruction came from the email, not from you.
- A "yes" in a chat can be one word typed too fast. A tap on a screen that shows the amount, the payee and the property is harder to do by accident.
- You need a record. An approvals queue with a time, a person and what they approved is something you can show a partner or an accountant later.
Anthropic's guidance for custom connectors says to review tool approval requests carefully and to be cautious with Allow always, and OpenAI's connection guide says to test write actions and record how confirmation behaves. Both treat confirmation as the owner's job. The cleanest design adds a second gate outside the chat for the high-stakes items.
What never goes into a chat
With a connector, the assistant reads from your records, so you rarely need to paste anything. When you do, follow the FTC's principle of keeping only what you need. In Protecting Personal Information, the FTC tells businesses to take stock of what they hold, scale down to what they need and lock it up.
- Never paste a Social Security number, ID image or full bank account number into a chat.
- Do not paste a screening report. Summarize the finding yourself if you need help wording a reply.
- Use unit labels and first names in prompts when the full details are not needed.
- Check your plan's data terms for chat history and training settings.
A checklist before you connect any assistant
- Can the assistant approve its own requests? It should not.
- Does every change show you a draft first?
- Can you see what it did, with a date and the item it touched?
- Can you disconnect it in one step?
- Does it read only your own portfolio?
- Where does your tenant data go besides the AI provider you chose?
Example a made-up owner asks an assistant to "pay the plumber's invoice". A safe setup answers that it queued the payment for approval and shows where to approve. An unsafe one answers "done". The first answer is slower by one tap, and that tap is the whole point.
How DoorKeeping handles it
DoorKeeping sorts every connector tool as a read, a draft you say yes to, or an item that asks for your Accept on doorkeeping.com. Money and legal steps, like paying a bill, a late fee rule or sending a lease notice, wait for your tap there. Your AI app can reject an item in your approvals queue but can never accept one. The connector reads only your own portfolio, and you can disconnect from Claude or ChatGPT at any time. See the full list on the connect page.
Sources
- Model Context Protocol: What is MCP?, read Oct 30, 2026
- Model Context Protocol: Architecture overview (tools, resources, prompts), read Oct 30, 2026
- Anthropic: Get started with custom connectors using remote MCP, read Oct 30, 2026
- OpenAI: Connect your MCP server to ChatGPT, read Oct 30, 2026
- FTC: Protecting Personal Information, A Guide for Business, read Oct 30, 2026
- DoorKeeping: Connect Claude or ChatGPT (steps and tools list), read Oct 30, 2026
Questions
- Can an AI assistant approve payments for me?
- It should not. Money steps should wait for your own approval outside the chat, and a good connector makes the assistant unable to approve for you.
- Is it safe to paste a tenant's SSN into ChatGPT or Claude?
- No. You almost never need to. Keep SSNs, ID images and bank numbers out of chats and use a private upload in your software.
- Can AI decide which applicant to accept?
- It can summarize facts you give it, but the decision is yours, made under one written rule applied to everyone, because fair housing law covers your decisions.
- What does Allow always mean in Claude?
- Anthropic's page warns to be cautious with it. It stops the per-use approval prompt for that tool, so use it for reads, not for tools that change records.