> ## Documentation Index > Fetch the complete documentation index at: https://docs.consile.ai/llms.txt > Use this file to discover all available pages before exploring further. # Actions & guardrails > What each connector can do: from read-only access to guardrailed write access with preview, confirmation, approval, company lock and access level per user. *[Læs siden på dansk](https://docs.consile.ai/essentials/handlinger-og-guardrails.md)* Connectors come in two types: some can only read your data, others can also create and manage content for you, but only behind clear safety barriers. Here is what each connector can do, in plain words. ## Two kinds of connectors > **Data connectors (read-only)** > > Google Search Console, Dinero, Billy, CVR, Ordrestyring and Business Central > (early access). Strictly read-only: your AI can read your > numbers, but never change, create or delete anything in your data source. There > are no write tools at all. > **Write connectors (read + guardrailed write)** > > e-conomic, Uniconta, Shopify, HubSpot CMS, HubSpot Marketing Email, > LinkedIn Ads and Meta Ads. Can read your data and create and manage content for you, but only behind > the guardrails described on this page. ## The principle: least privilege Our pure data connectors (Google Search Console, Dinero, Billy, CVR, Ordrestyring and Business Central) have no write tools: your AI can read your numbers, but never change, create or delete anything. Our write connectors (e-conomic, Uniconta, Shopify, HubSpot CMS, HubSpot Marketing Email, LinkedIn Ads and Meta Ads) can also create and manage content for you, but only behind clear safety barriers. By default, new ads, products, pages, blog posts and emails are created as drafts or paused. Spending money, changing a budget or bid, changing price or inventory, publishing or sending, posting to the accounts, archiving or deleting requires your explicit confirmation by default. Without confirmation, you only get a preview, and nothing is changed. > [!NOTE] > > Guardrails are built-in safety defaults in the write tools. > How the confirmation works is described under the universal rules below. Some > writes, for example saving a draft, require no confirmation (see the list > further down). Consile enforces three things on the server, whatever your AI does: > a data connector has no write tools, a user on the **Read only** access level > cannot use write tools (see > [Access level per user](#access-level-per-user)), and a tool that an > administrator has set to require approval runs only once an > administrator has approved the call (see > [Approval from an administrator](#approval-from-an-administrator)). ## The read-only data connectors These connectors have zero write tools. Your AI can only read. | Connector | Access | Tools | Price/month excl. VAT | | - | - | - | - | | Google Search Console | Read-only access | 7 read-only | 249 DKK | | Dinero | Read-only access | 52 read-only | 299 DKK | | Billy | Read-only access | 17 read-only | 299 DKK | | CVR | Read-only access | 5 read-only | 99 DKK | | Ordrestyring | Read-only access | 9 read-only | 299 DKK | | Business Central (early access) | Read-only access | 5 read-only | 449 DKK | The prices are excl. VAT and apply when the connector is bought on its own. The price covers 1 user and 1 agreement. An agreement is the portal's word for one connection to a system. All connectors on this page are also included in [the Consile Studio membership](https://docs.consile.ai/en/portal/membership.md), and all except CVR in [the free edition](https://docs.consile.ai/en/portal/free-edition.md). See [Pricing](https://docs.consile.ai/en/portal/pricing.md). If you ask Dinero about your invoices, for example, your AI calls the tool `dinero__list_invoices` for you: it fetches figures and can never post or change anything. Ordrestyring also has a tool for free-form queries (`graphql_query`), but the connector refuses anything other than reading before the query is sent to Ordrestyring. Business Central is in early access with five read tools. The access Microsoft grants at authorization also covers writing, so it is Consile that enforces read-only: the connector can only send read requests. See [Business Central](https://docs.consile.ai/en/connectors/business-central.md). Read more in [Security & data](https://docs.consile.ai/en/essentials/security-and-data.md). ## The guardrailed write connectors These connectors can read your data and also create and manage content. Whenever an action can cost money, go live or change something important, guardrails take effect. | Connector | Access | Tools | Price/month excl. VAT | | - | - | - | - | | e-conomic | Read + guardrailed write | 40 (28 read / 12 write) | 299 DKK | | Uniconta | Read + guardrailed write in the daily journal | 25 (21 read / 4 write) | 299 DKK | | Shopify | Read + guardrailed write | 50 (40 read / 10 write) | 349 DKK | | HubSpot CMS | Read + guardrailed write | 23 (14 read / 9 write) | 299 DKK | | HubSpot Marketing Email | Read + guardrailed write | 19 (8 read / 11 write) | 149 DKK | | LinkedIn Ads | Read + guardrailed write | 64 (45 read / 19 write) | 399 DKK | | Meta Ads | Read + guardrailed write | 39 (34 read / 5 write) | 299 DKK | ### The universal guardrail rules These rules apply to the write connectors: **1. New content is created as a draft or paused** If your AI creates an ad, a product, a page, a blog post or an email, it does not go live by default: new Meta ads are created as `PAUSED`, and new LinkedIn campaigns, Shopify products and HubSpot pages, blog posts and emails as drafts (`DRAFT`). A HubSpot marketing email that is a draft is not sent. In e-conomic, invoices and credit notes are created only as drafts, and in Uniconta, journal lines are created only as unposted lines in the daily journal. A new customer in e-conomic, on the other hand, is created as a real customer once you have confirmed. A new variant on a Shopify product that is already live can, however, become visible and purchasable in the store right away. If something is to be created as active or go live later, that requires your confirmation. **2. Anything that costs money or goes live requires your confirmation** Activating a campaign (spending money), changing a budget or bid, changing price or inventory, publishing to a live website, sending a marketing email, posting to the accounts, or archiving or deleting requires an explicit yes from you (`confirm:true`). In e-conomic and Uniconta, all writes require confirmation. The few exceptions are in the list of writes without confirmation further down. **3. Without confirmation, you only get a preview** If you do not confirm, the tool instead returns a preview (a "dry run") that shows exactly what *would* happen. Nothing is written at the provider. For edits, the confirming call applies your changes to the record as it looks at that moment. > [!NOTE] > > The confirmation is the field `confirm:true` in the call, and it is your AI that sends > it. The server does not require a separate preview call first. The exception > is posting in e-conomic and Uniconta, where the confirmation must contain a value > from the preview. Your AI should show you the preview and only send > `confirm:true` once you have said yes. Read the preview before you answer. Without > `confirm:true`, your AI cannot start ad spend, publish to a > live website, send an email, move a budget, post to the accounts, archive > or delete content. The only exception is removing a reaction on > LinkedIn. > [!TIP] > > In your AI client, you control what your AI may do. In Claude, under > **Customize → Connectors**, you can choose per tool whether Claude may use it freely, whether > Claude should ask you first, or whether the tool should be blocked. We recommend > letting the read tools run freely, and requiring your approval for all tools that > create, change, publish, post or delete. > Consile marks each tool as reading or changing, so the client can > tell them apart. The setting applies only to you and your client. If a tool should require > approval for everyone in the organization, an administrator sets a rule in the > portal (see [Approval from an administrator](#approval-from-an-administrator)). ### Writes without confirmation Some writes are carried out right away, without a preview. None of them activates a campaign, changes an existing budget or bid, or sends anything, but some of them change something that is already live: * HubSpot CMS: create and edit drafts of pages and blog posts, and create or edit rows in a HubDB table's draft. Nothing becomes visible on the website before publishing. * HubSpot Marketing Email: create and edit email drafts, clone an email and create an A/B variant. A draft is not sent. * Meta Ads: create campaigns, ad sets and ads paused, and pause an object. * LinkedIn Ads: create campaign groups and campaigns as drafts or paused; change the name or end date of a campaign group and the name or targeting of a campaign (also a campaign that is running), as long as budget and bid are not changed; set campaign groups, campaigns and ads to draft or paused; create, edit and associate conversion rules. The organic tools (which are not available yet, see below) can also create posts as drafts and remove a reaction without confirmation. * Shopify: create a product as a draft; edit title, description, vendor, type and tags (on an active product, the change shows in the store right away); set a product to draft (this removes an active product from the store); add variants, also with a price and also on an active product; and edit variants, for example SKU or barcode, without changing the price. * e-conomic: none. All writes require confirmation. * Uniconta: none. All writes require confirmation. ### How each write connector works * e-conomic has 12 write tools, and all require confirmation. A call without `confirm:true` never writes anything in e-conomic and only gives a preview. * Eight work with customers and sales documents: `create_customer`, `update_customer`, `create_customer_contact`, `create_delivery_location`, `create_draft_invoice`, `update_draft_invoice`, `duplicate_invoice` and `create_credit_note`. Invoices and credit notes are created and edited only as drafts. Your AI cannot post or send them; you do that yourself in e-conomic. * Four work in the daily journal: `create_journal_entries`, `update_journal_entries`, `delete_journal_entry` and `book_journal_entries`. New and edited entries remain unposted. `book_journal_entries` posts to the accounts, but only the entry numbers you have seen in the preview (at most 50 per call, never the whole journal). The posting is refused if one of the entries has changed since the preview. * The only thing that can be deleted is one unposted entry at a time in the daily journal. Posted entries cannot be edited or deleted; an error is corrected with a new entry. * An administrator can set the individual user to **Read only** (see [Access level per user](#access-level-per-user)). * Uniconta has 4 write tools, and they work only in the daily journal. All require confirmation, and a call without `confirm:true` only gives a preview. `create_journal_lines`, `update_journal_lines` and `delete_journal_line` create, edit and delete unposted lines. `post_journal_lines` posts only the line IDs you have seen in the preview (at most 50 per call, never the whole journal), and the posting is refused if one of the lines has changed since the preview. The read tools, for example `uniconta__get_account_balance`, only fetch figures and can never post or change anything. Customers, suppliers, items, invoices and posted entries cannot be changed. An administrator can set the individual user to **Read only** (see [Access level per user](#access-level-per-user)). See [Uniconta](https://docs.consile.ai/en/connectors/uniconta.md). * Shopify can only write to products, variants, publishing and inventory. Orders, customers, discounts and so on are read-only, and `graphql_query` refuses anything other than a single read query. New products are created as drafts. Publishing, unpublishing, setting a product live or archiving it, changing a price, changing inventory or deleting a variant requires `confirm:true`. There is no tool for deleting a product. Some edits are carried out without confirmation (see the list above). * HubSpot CMS writes freely in drafts of pages, blog posts and HubDB tables. Publishing pages, blog posts and HubDB tables to the live website and resetting a HubDB draft require `confirm:true`. There is no delete tool. * HubSpot Marketing Email lets you work freely in drafts (create/edit draft, clone, A/B variant), and a draft is never sent on its own. Sending happens only through the confirmed `publish_email`. Editing the live version of an email, resetting a draft, restoring an earlier version, unpublishing or deleting (archiving) an email also requires confirmation. * LinkedIn Ads and Meta Ads: see the ad-specific rules below. ### Special rules for ad connectors For Meta Ads and LinkedIn Ads, the following also applies: **1. New ad objects are created paused or as drafts** If your AI creates a new ad object, it does not go live by default. On Meta, campaigns, ad sets and ads are created as `PAUSED`. On LinkedIn, campaign groups and campaigns are created as `DRAFT` (ads cannot be created through the connector). If an object is to be created as active, or activated later, that requires your confirmation. **2. No permanent deletion on Meta** Meta Ads has no delete tool: content can only be archived, and that requires your confirmation. ### LinkedIn: tools that are not available yet 22 of LinkedIn Ads' 64 tools are not available yet. You can see them, but calls to them fail, and nothing is posted or changed. This applies to: * 8 write tools for organic posts, comments and reactions: `create_organization_post`, `create_member_post`, `update_post`, `delete_post`, `create_comment`, `delete_comment`, `create_reaction` and `delete_reaction`. * 14 read tools for company pages, posts and your own profile: `list_administered_organizations`, `get_organization`, `find_organization_by_vanity_name`, `get_organization_follower_count`, `get_organization_page_statistics`, `get_organization_follower_statistics`, `get_organization_share_statistics`, `list_organization_posts`, `get_post`, `get_post_social_metadata`, `list_post_comments`, `list_post_reactions`, `get_my_profile` and `get_my_connections_count`. The tools for ad accounts, campaigns, reporting, audiences, conversions and lead forms work. ## Access level per user For e-conomic and Uniconta, an administrator can choose how much the individual user may do through Consile. There are two levels: | Level | What the user's AI can do | Tools in e-conomic | Tools in Uniconta | | - | - | - | - | | **Read only** | Read the accounts. All tools that change data are switched off for the user. | 28 | 21 | | **Full access** | Read and use all write tools behind the guardrails described above. | 40 | 25 | * The level is chosen per user under [Team](https://docs.consile.ai/en/portal/team.md). An administrator opens the user's page and, on the **MCPs** card next to the connector, chooses: for e-conomic **Read only (28)** or **Full access (40)**, for Uniconta **Read only (21)** or **Full access (25)**. The numbers count the tools the organization has switched on, so they may be lower for you. Only administrators see and change the levels. * Both levels cost the same. A user counts as one user on the subscription, whatever the level, and switching between the two levels requires no confirmation. If you choose a level for a user who does not have access to the connector yet, the user gets access at the same time. If it is not the included first user, it costs 50% of the monthly price, and the portal asks you to confirm the purchase. See [Pricing](https://docs.consile.ai/en/portal/pricing.md). * The default is **Full access**. If nobody has chosen a level, the user has full access. * The level applies to all the e-conomic or Uniconta agreements you have connected. * With [the Consile Studio membership](https://docs.consile.ai/en/portal/membership.md), the level is set the same way for the person who has the membership licence. * Consile enforces the level on the server. A user on **Read only** sees only the read tools, and a call to a write tool is refused before anything happens in e-conomic or Uniconta. Your AI is told that the tool is not switched on for the user and that nothing has been changed. The connection to the system is the same for the whole company; it is Consile that blocks all write operations on the server for that user. * The change takes effect within a few seconds. A conversation that is already open may still show the old tools, but a write call is refused. Start a new conversation to get the updated list. In [Microsoft 365 Copilot](https://docs.consile.ai/en/connect/connect-microsoft-copilot.md) (pilot), a user on **Read only** always sees the write actions, but they are refused in the same way. On the other connectors, the administrator chooses **All tools**, which gives all the tools that are switched on for the organization. On all connectors, an administrator can also choose **Custom** and pick exactly the tools a user gets (see [Team](https://docs.consile.ai/en/portal/team.md#custom-access)). ## Approval from an administrator An administrator can decide that a tool must not run on its own. This is done under **Team** → **Approvals**, where the administrator switches on **Requires approval** next to the tool. The button **Require approval for every writing tool** sets the rule on all tools in a system that change data. The rule can also be set on a tool that only reads. * The rule applies to the whole organization: all users, including administrators, and all AI bots. It applies to all agreements in the system. * Consile enforces the rule on the server. The call waits, and nothing is carried out until an administrator has approved it in the portal. Your AI is told that the call is waiting. * The administrator can approve **This call only** or all calls of the tool for the person for 1, 4 or 8 hours. If the administrator refuses, the call is not carried out, and your AI is told. * The tool is still in the list of tools in your AI. It is only the call that waits. The rule works together with the confirmation in the write tools. A write tool with a rule therefore requires both `confirm:true` and an administrator's approval before anything happens. The call without `confirm:true`, which only gives a preview, also waits for approval. If the administrator approves **This call only**, the confirming call must therefore be approved separately. A window of 1, 4 or 8 hours covers both calls. Only administrators can use Approvals. See [Approvals](https://docs.consile.ai/en/portal/approvals.md). ## Company lock: one company per connection In Google Search Console, Meta Ads, LinkedIn Ads, Dinero and Business Central, one connection can reach several companies, for example several websites or ad accounts. An administrator can lock each agreement to one company. The lock then narrows what the connection can reach: * Every call stays with that company. A call to another company is refused, and nothing is fetched or changed. * The list of companies shows only that one. * Tools that cannot be limited to one company are hidden on the agreement: 11 of 39 in Meta Ads, 28 of 64 in LinkedIn Ads and 1 of 5 in Business Central. In Search Console and Dinero, none are hidden. On Meta Ads, `update_status` and `update_budget` are hidden, so your AI can neither activate, pause, archive nor change the budget on a locked agreement. The lock is optional. An agreement without a lock works as before, and your AI chooses the company in each call. See [Company lock](https://docs.consile.ai/en/portal/company-lock.md). ## AI bots ask nobody An [AI bot](https://docs.consile.ai/en/studio/ai-bots.md) works on its own with a key, without a person beside it. The portal puts it like this: *The bot asks nobody before it writes. The only guard is which tools are in the connector.* * Nobody reads a preview, so the confirmation in the write tools does not protect against a bot. Put only the tools the bot needs in the bot's connector. * Only administrators can make an AI bot. If the bot's connector has tools that change data, an administrator must confirm them by typing the bot's name before the bot goes live. * If an administrator has set an approval rule on a tool, the bot's calls also wait for approval. ## One connector, one address Each connector has its own address with only its own tools: * Google Search Console: `mcp.consile.ai/gsc/mcp` * Uniconta: `mcp.consile.ai/uniconta/mcp` * e-conomic: `mcp.consile.ai/economic/mcp` * Dinero: `mcp.consile.ai/dinero/mcp` * Billy: `mcp.consile.ai/billy/mcp` * CVR: `mcp.consile.ai/cvr/mcp` * Ordrestyring: `mcp.consile.ai/ordrestyring/mcp` * Business Central: `mcp.consile.ai/business-central/mcp` * Shopify: `mcp.consile.ai/shopify/mcp` * HubSpot CMS: `mcp.consile.ai/hubspot/mcp` * HubSpot Marketing Email: `mcp.consile.ai/hubspot-email/mcp` * LinkedIn Ads: `mcp.consile.ai/linkedin-ads/mcp` * Meta Ads: `mcp.consile.ai/meta-ads/mcp` If you have bought an extra agreement for a connector, it gets its own address, for example `mcp.consile.ai/economic-2/mcp`. An own connector in [Studio](https://docs.consile.ai/en/studio/own-connectors.md) also has its own address, for example `mcp.consile.ai/studio/s_/mcp`, with only the tools chosen for it. The rules on this page apply there too. The shared address `mcp.consile.ai/mcp` is [Consile Concierge](https://docs.consile.ai/en/concierge.md): it contains only tools to see your MCPs, find new ones, connect accounts, get links for purchases and subscriptions, and write to support, not connector tools. The actions themselves always happen against the individual connector's own address. > [!NOTE] > > Tools are named `connector__tool` (for example `shopify__set_product_status`). Your > AI calls them for you based on what you ask for, and you do not have to > type them yourself. If you have questions about what a particular connector may and may not do, write to [support@consile.dk](mailto:support@consile.dk). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.