The Boundary Is What Leaves the CRM

For trycompai/crm, security is not only a question of which records the agent can open. It is also a question of what information and authority can cross the CRM’s boundary. The design allows broad internal reading so the agent can use real history, then narrows external egress, sandbox access, bridge identity, and telemetry. That direction-of-flow model explains how the CRM stays useful without treating access as permission to disclose or act without limits.

Broad internal reading, narrow external movement

The agent can read the internal CRM broadly. Contact history can include full email bodies, meeting notes, attendee lists, deal history, and other information needed to understand a relationship. That access is deliberate. A signature block can settle a job title. A reply from an address can establish that the person interacted with the organization. A meeting can connect a person to a real business context.

The boundary begins when information is about to leave the CRM. The agent must not put customer text into a third-party query. It can ask a derived question about a public fact, but it cannot paste a private message into a search request and ask a provider to interpret it. The distinction is easy to state and important to enforce. The first query asks about the world. The second exports somebody else’s words.

Mailbox content also cannot be copied into the sandbox workspace. The mailbox and the workspace have different lifetimes and audiences. A dossier of public profile data can be useful to a turn. A private message written to a file can outlive the turn and become available to a different process. The design therefore keeps internal message bodies in the conversation and restricts what the sandbox can retain.

The record itself has a business boundary. The agent can write work context such as a name, title, employer, tenure, public profile, or public news. It must not turn personal details into CRM fields merely because a source volunteers them. Health, politics, religion, sexuality, ethnicity, and union membership remain outside the record. Broad reading does not mean unlimited filing.

Consider a title investigation with a private thread and a public company announcement. The agent can read the thread to understand the relationship and then ask a public question about the company’s announcement. It does not need to quote the private message to make the public lookup useful. If the external capability is absent, it can state that the source was unavailable and continue with the internal history. The boundary changes the question that leaves the system, not the amount of context the agent can use to reason responsibly.

Images follow the same direction. A profile photo can strengthen a record’s appearance, which makes a wrong identity especially costly. Comp AI CRM copies a photograph only from a source already tied to an identifier on the person’s record.