Using MCP to Give AI Safe Access to Internal Company Data
A design guide to MCP for organisations: per-user permissions, read-only data views, audit logs, and admin controls in Claude and ChatGPT.
The sales director of a construction materials distributor wants sales reps to ask AI, "How much does this customer owe, and how much credit is left?" instead of calling accounting every time. IT replies: "Fine, but reps must not see other reps' customers, and we need an audit trail." That is the real challenge of using MCP inside a company.
What does using MCP with internal data mean?
It means building an MCP Server that wraps internal systems such as ERP, CRM or document stores, so the AI apps employees use can retrieve data according to each person's permissions. The point is not just connecting. It is connecting with control.
Five design principles
1. Authenticate each person, not a shared account
Remote Servers should use OAuth through the organisation's login system. The Claude Help Center warns that with a shared credential on Team or Enterprise plans, everyone gets that credential's access, so its scope should be as narrow as possible.
2. The tools each person sees depend on permissions
The MCP Tools specification allows a Server to return different tool lists depending on the authorization presented with the request. A sales rep might see only the outstanding-balance tool, while a manager also sees a credit-approval tool. Inside each tool, data must still be filtered by user every time.
3. Read through restricted views first
Do not connect the Server to your main database with full rights. Create a view or API that returns only the fields needed, such as balance and due date, without unrelated personal data.
4. Log every call
The spec recommends that Clients log tool usage for auditing, and the Server should also record who called which tool, with what input, and when, so you can investigate incidents.
5. Validate inputs, rate-limit and sanitise outputs
The spec requires Servers to validate inputs, enforce access controls, rate-limit calls and sanitise outputs before returning them.
Admin-side controls
- Claude Team and Enterprise: Owners add connectors in Organization settings, then members connect their own accounts.
- ChatGPT Enterprise and Edu: the OpenAI Help Center says admins choose which actions an app can perform and which groups can access it. New actions are off by default, and an approved app uses a frozen snapshot of its tools until an admin reviews and republishes.
Data inside your private network
This is where many organisations get stuck. Claude says remote connectors must be reachable from the internet; behind a VPN or firewall you need to allowlist Anthropic's IPs. ChatGPT says private or local servers need the Secure MCP Tunnel. A common pattern is to place the MCP Server at the network edge, accept connections only from permitted sources, and let the Server talk to internal systems from there.
Things to watch out for
- PDPA: customer and employee data is personal data. Consult your legal team or a qualified professional about the legal basis and about sending data to AI providers.
- Do not start with tools that write data. Begin read-only, then add actions that require human confirmation.
- Internal Servers do not belong in public registries. The MCP Registry documentation says it does not support private servers and recommends hosting your own private registry.
- Review permissions regularly, especially when people change departments or leave.
AI should see exactly what that employee can see. Not one row more.
How to get started
- Pick one use case that answers repeated questions, such as a rep's own customers' outstanding balances
- Define who should see what before writing the first line of code
- Build a read-only view and an MCP Server that signs in through your organisation's login
- Open it to a small pilot group, keep logs and review them weekly
- Expand once you trust the permissions and the answer quality
If your organisation is unsure how ready it is, SCALE runs AI Readiness Diagnostic and AI Governance workshops; contact them at scale.co.th. For security basics, read MCP security.