--- title: "How to Stop an AI Agent From Deleting Records" url: https://www.insulin.dev/blog/stop-ai-agent-deleting-records/ canonical: https://www.insulin.dev/blog/stop-ai-agent-deleting-records/ type: Blog description: "Stop an AI agent from deleting records in Insulin: set each integration to Edit, which changes records but never deletes them. Full, the default, deletes." --- # How to Stop an AI Agent From Deleting Records > Canonical HTML version: https://www.insulin.dev/blog/stop-ai-agent-deleting-records/ 1. [Home](/) 2. [Blog](/blog/) 3. How to Stop an AI Agent From Deleting Records # How to Stop an AI Agent From Deleting Records Insulin's Edit level lets an agent create and change records but never delete them, and Full, the level that deletes, is the default. What counts as a delete, where one is possible, and a five-step review of your agents. ![Chengjun Yuan](/leadership/chengjun.jpeg) Chengjun Yuan Co-founder & CTO · Oct 23, 2026 ![How to Stop an AI Agent From Deleting Records](/images/blog/stop-ai-agent-deleting-records/hero.png) Explore AI Summary [![](/logos/company/openai.svg)](https://chat.openai.com/?q=Read%20and%20summarize%20https%3A%2F%2Fwww.insulin.dev%2Fblog%2Fstop-ai-agent-deleting-records%2F%2C%20then%20cite%20the%20source.%20Focus%20on%20what%20it%20says%20about%20Security%2C%20Integrations. "Summarize with ChatGPT")[![](/logos/company/anthropic.svg) ](https://claude.ai/new?q=Read%20and%20summarize%20https%3A%2F%2Fwww.insulin.dev%2Fblog%2Fstop-ai-agent-deleting-records%2F%2C%20then%20cite%20the%20source.%20Focus%20on%20what%20it%20says%20about%20Security%2C%20Integrations. "Summarize with Claude")[![](/logos/company/gemini.svg)](https://www.google.com/search?udm=50&aep=11&q=Read%20and%20summarize%20https%3A%2F%2Fwww.insulin.dev%2Fblog%2Fstop-ai-agent-deleting-records%2F%2C%20then%20cite%20the%20source.%20Focus%20on%20what%20it%20says%20about%20Security%2C%20Integrations. "Summarize with Gemini")[](https://www.perplexity.ai/search/new?q=Read%20and%20summarize%20https%3A%2F%2Fwww.insulin.dev%2Fblog%2Fstop-ai-agent-deleting-records%2F%2C%20then%20cite%20the%20source.%20Focus%20on%20what%20it%20says%20about%20Security%2C%20Integrations. "Summarize with Perplexity") Table of Contents - [How do you stop an AI agent from deleting records?](#how-do-you-stop-an-ai-agent-from-deleting-records) - [What counts as a delete in Insulin?](#what-counts-as-a-delete-in-insulin) - [Where can an AI agent delete records in Insulin?](#where-can-an-ai-agent-delete-records-in-insulin) - [Will Insulin ask before an agent deletes something?](#will-insulin-ask-before-an-agent-deletes-something) - [How do you check what an agent can delete?](#how-do-you-check-what-an-agent-can-delete) - [How do you review your agents for delete access?](#how-do-you-review-your-agents-for-delete-access) - [Frequently asked questions](#frequently-asked-questions) - [Takeaways](#takeaways) _The way to stop an AI agent from deleting records in Insulin is the Edit access level. Set on each integration an agent uses, Edit lets the agent read, create and change records in that system, but never delete them. Full, the level that also deletes, is the default, and every integration selected before the setting existed keeps it._ * * * “Can it change records but never delete them?” is what an IT or security owner asks once an agent is trusted to write. Until recently, Insulin’s answer was no: each integration was Read-only or Edit, and Edit kept every tool, deletes included. Now there’s a third level, and the line falls where the question draws it. Edit creates and changes records; Full also deletes them. Nothing got looser in the change. Edit got narrower, and an integration selected before the setting existed keeps Full, which is everything it could already do. That’s also why the work falls to you: an integration nobody has narrowed runs at Full, so it can still delete, and it will until someone looks. This post covers what Fours counts as a delete, every place in Insulin where one is possible, whether anything waits for you, how to confirm what an agent holds, and a five-step review. ## How do you stop an AI agent from deleting records? **Set each integration the agent uses to Edit, on the agent itself.** Edit is the middle of Insulin’s three access levels, and [Fours’ Agents documentation](https://doc.fours.com/insulin/agents/#integrations-and-knowledge-bases) gives the whole scale in one line: “Read-only looks things up, Edit also changes records, Full also deletes them.” Level What the agent can do, per Fours’ docs Set it when **Read-only** ”Use only that integration’s read tools — listing, searching, fetching.” A tool Fours doesn’t recognise as a read is treated as a write The job is answering from the system **Edit** ”Read from the integration, and create and change records there, but not delete them” The job is updating the system **Full** ”Everything **Edit** allows, plus deleting.” The default, and what an integration selected before the setting existed keeps Removing records is the job itself The level is a select beside each integration in a custom agent’s **Integrations** list. On an organization agent, only an org admin can change it, which Fours says “prevents a shared agent from being quietly granted new organization-level tool access by someone without admin privileges.” The built-in Insulin assistant offers the same three levels for your own connections, covered below. **Why a setting and not a prompt.** AWS’s Well-Architected guidance calls the risk [excessive agency](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec05-bp01.html): an agent “determines the best solution to a problem is to take broader actions beyond its scope.” AWS adds that this “is not inherently malicious but rather an unintended consequence of automation, especially since the agent has little knowledge beyond the prompt as to what behaviors are permitted or not.” An instruction such as _never delete anything_ is something a model may follow. A delete tool that Edit removed is one the agent doesn’t have. Two layers sit around the level. Before it, the allowlist: [restricting which integrations an AI agent can access](/blog/scope-an-agent-to-its-integrations/) decides which systems the agent reaches at all. After it, the credential: Edit narrows the tools on offer, and each system’s own role, scopes or key decide what the remaining tools can do there. [Where read-only access for AI agents is set](/blog/read-only-access-for-ai-agents/) walks through that ceiling system by system. ## What counts as a delete in Insulin? **A delete is anything that takes a record out of a service, whatever the service calls it.** The Agents documentation’s definition reaches past the word: “A delete is anything that takes a record out of that service — including what the service calls archiving, trashing, voiding or revoking — and a tool that runs arbitrary queries, such as a SQL statement, counts as one.” What counts as a delete Tools on Fours’ integration pages that do it **Deleting** Outlook’s `delete-message`; Gong’s `delete-data-for-email`, for GDPR data requests **Archiving** Notion’s `archive-page`; monday’s `archive-item` **Trashing** Google Drive’s `googledrive_trash_file`, which moves a file to Trash **Voiding** Avalara’s `void-transaction` **Revoking** Google Drive’s `googledrive_unshare_file`, which revokes a share **Running any SQL** BigQuery’s `run-query` and Databricks’ `run-sql`, which run whatever statement they’re given **Names that don’t say so** Intercom’s `merge-contacts`; Outlook’s `cancel-event` The last two rows are where reviews get surprised. The [Agent access levels](https://doc.fours.com/integrations/#agent-access-levels) table names four tools whose names don’t say so: `run-query` (BigQuery) and `run-sql` (Databricks), “which run any SQL statement they are given”, `merge-contacts` (Intercom) and `cancel-event` (Microsoft Outlook). On Edit, each one is gone. The warehouses keep the rest: on Edit, a BigQuery agent “can still list datasets and tables and read their schemas, but it can’t run a query,” and a Databricks agent keeps “the other nine tools, which only read.” **Four names is the docs’ list, not a promise about every other tool.** Fours takes each tool’s level “from the integration’s own definition of that tool where it has one, and otherwise from the tool’s name,” so two cases call for a check rather than a guess: - **Provider-served tools.** “An integration served by its provider’s own MCP server, such as Datadog, gives an agent that server’s tools instead, which can differ from the list.” Datadog’s page lists `disable-user`, whose name doesn’t say _delete_: ask the agent whether it holds that tool on Edit. - **MCP servers you add yourself.** “Tools from an MCP server you add yourself are judged by their names, and one Fours doesn’t recognise as a read counts as a change,” which Edit allows. A destructive tool whose name doesn’t read as a delete can reach an agent on Edit, so keep a server you don’t know on Read-only. **A send isn’t a delete.** Sending an email takes nothing out of the mailbox, so it’s a change, and an agent on Edit keeps its send tools. [Whether an AI agent can send email without asking](/blog/ai-agent-send-email-without-asking/) covers that question. ## Where can an AI agent delete records in Insulin? **Wherever an integration sits at Full, and that’s every integration nobody has narrowed.** The levels apply in more than one place, and each place has its own owner and default: Where Who sets the level Default What to know **A custom agent’s integration** A personal agent’s owner; on an organization agent, only an org admin **Full**, kept by every integration selected before the setting existed A job runs as the agent that created it, “with that agent’s access to resources and integrations” **The built-in Insulin assistant** You, for yourself: the **pencil** in a chat with Insulin, then **Integrations** **Full**: “An integration you leave alone stays at **Full**” Your levels narrow Insulin for you, not for anyone else, and the Slack bot follows them. If Fours can’t read your levels when a turn starts, that turn runs with every integration at **Read-only** **Fours’ MCP server on an organization agent** Fixed **Edit**, shown as a badge Added by an org admin, and listed under Fours’ former name. It reads and changes records on the organization’s credential, “but never delete them,” and its tools attach only when the person the agent works for is an org ADMIN or EDITOR **Your own Fours MCP connection** You, on the card when you connect **Read only** Agents show the card’s level as a badge: **Read only** as Read-only, **Read & write** as Edit, **Read, write & delete** as Full. To change it, disconnect and connect again **A knowledge base attached to an agent** The agent’s configuration, per knowledge base Chosen when you attach it **Read** or **Edit**. Edit creates, updates and deprecates files, “never delete,” and a deprecated file is “retired from search but not deleted” **An Inbox CRM action you approve** You, by clicking **Run in chat** Not applicable It “is not held to these levels: you approved that one action on that one connection.” The run reaches only the CRM connection the action came from Two rows are easy to misread. The organization agent’s Fours MCP server has no select at all, so it can never be raised to Full there. And the CRM action is the exception the docs name: a write that runs outside these levels, because you authorize each action yourself and [Inbox](https://doc.fours.com/insulin/inbox/#running-a-crm-action) limits the run to that one CRM. ## Will Insulin ask before an agent deletes something? **Only when you @mention Insulin in a Slack channel. Everywhere else, the level is the boundary.** Fours’ [Tool Approvals](https://doc.fours.com/insulin/agents/#tool-approvals) section lists what pauses: “posting a message to Slack, since other people can read it the moment it is sent, and — when you mention Insulin in a Slack channel — anything it can’t recognize as a read.” - **A web chat or a Slack DM.** Only posting a Slack message waits. A delete the agent holds runs when it’s called. - **A Slack channel mention.** The turn is treated as untrusted, and “anything it can’t recognize as a read waits for your approval first.” Slack reaches the built-in assistant, so this covers your own connections, not a custom agent’s. - **An Insulin channel, a Microsoft Teams DM, a sub-thread reply or a job run.** The card “is _not_ offered — and the action is _not_ held back.” A scheduled job whose agent holds Full deletes with nobody watching. AWS’s least-privilege practice also says to “implement user confirmation for the agent, requiring users to confirm agent actions.” Insulin’s card does that for Slack posts and Slack-channel requests only, so for a delete, the control that holds on every surface is the level you set beforehand. ## How do you check what an agent can delete? **Ask the agent to list the actions it can call: that list follows the integration’s access level.** Every agent can [list the actions an integration supports](https://doc.fours.com/insulin/agents/#asking-an-agent-about-its-own-integrations), described as “the provider actions this agent may actually call, given the integration’s access level and the kind of turn it is running, each with a description and whether it is read-only.” The **Actions** tab answers a different question. On an integration’s **Details**, from its card’s **⋯** menu in **Settings → Integrations**, each action is “marked **Read-only** or **Mutating** — a Mutating action needs **Edit**, or **Full** when it removes something.” The tab tells you a tool writes, not whether Edit keeps it, because a change and a removal carry the same label. So check with the agent. Set Intercom to Edit, then ask _List the Intercom actions you can call, and say which ones aren’t read-only._ If `merge-contacts` is on the list, the integration isn’t on Edit. Do the same for a provider-served integration such as Datadog, and for any MCP server you added yourself. The list shows which tools the agent holds; the system’s credential still decides whether each call succeeds. ## How do you review your agents for delete access? **Five steps: open each agent’s integrations, set Edit where writing is the job, keep Full only where deleting is, check the integrations that run SQL, and set your own assistant’s levels.** 1. **Open each agent’s Integrations list.** Assume Full on anything you haven’t set, since “an integration you never narrow runs at **Full**.” An organization agent’s list takes an org admin. Personal agents are private to their owners, so ask the people who build them to run the same review. 2. **Set Edit wherever changing records is the job,** and Read-only wherever reading is. An agent that updates Notion pages or Intercom contacts does that work on Edit. 3. **Keep Full only where deleting is the job,** such as an agent whose task is archiving stale pages. Don’t widen a level because a call failed: AWS lists “expanding agent permissions in response to access errors without investigating whether the access pattern is legitimate” among the [anti-patterns of least privilege](https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentsec03-bp03.html), whose goal is agents with “the minimum permissions required to complete their defined tasks.” When an agent on Edit says it can’t archive something, decide whether archiving is its job before you move it to Full. 4. **Check the integrations that run SQL.** BigQuery’s `run-query` and Databricks’ `run-sql` come only with Full, so a warehouse agent that must query keeps Full, and its boundary moves into the warehouse’s own permissions. [Setting up a query-only AI agent for BigQuery](/blog/ai-agent-for-bigquery/) covers which roles to grant. 5. **Set your own assistant’s levels.** In a chat with Insulin, open the **pencil**, then **Integrations**, and set each connection; the levels follow you into Slack. Outlook connects per user only, so its `delete-message` and `cancel-event` reach only your own assistant and personal agents. Then read the **Access** on your own Fours MCP connection’s card, and reconnect it if it says more than the work needs. ## Frequently asked questions ### Can an AI agent change records but never delete them? Yes. In Insulin, set the integration to Edit on the agent. Edit reads, creates and changes records but never deletes them, and Fours counts archiving, trashing, voiding, revoking and running arbitrary SQL as deleting. Full, the level that also deletes, is the default. ### What access level does an agent’s integration have by default? Full. An integration you never narrow runs at Full, and every integration selected before the access setting existed keeps it, so the agent can use every tool, deletes included. The built-in Insulin assistant works the same way: an integration you leave alone stays at Full. ### Does Edit stop an agent from running SQL? Yes. The run-query tool in BigQuery and run-sql in Databricks run any statement they are given, so Fours counts each as a delete and an agent gets them only with Full. On Edit or Read-only, it can still list tables and read their schemas, but not run a query. ### Can the Fours MCP server delete records? Not on an organization agent, where it carries a fixed Edit badge: it reads and changes records but never deletes them. On your own connection, only if you chose Read, write & delete when you connected it. Read only is the default, and changing the level means reconnecting. ### Will Insulin ask before an agent deletes something? Only when you @mention Insulin in a Slack channel, where anything it can’t recognize as a read waits for your approval. In a web chat or Slack DM, only a Slack post waits, and job runs, Insulin channels and Teams never pause, so the level is the boundary. ### How do I see what an agent can delete at its level? Ask the agent to list the actions it can call: the list follows the integration’s access level. An integration’s Actions tab marks each action only Read-only or Mutating, and a Mutating action that removes something needs Full, so the tab can’t tell you what Edit keeps. ## Takeaways - **Edit changes, Full deletes.** Set Edit wherever an agent’s job is to update a system: it reads, creates and changes records there, and never deletes them. - **Full is the default.** An integration nobody has narrowed runs at Full, and every integration selected before the setting existed keeps it, so review before you assume. - **A delete is broader than the word.** Archiving, trashing, voiding, revoking and any-SQL tools count, and the docs name four tools whose names don’t say so. - **Only a Slack-channel request waits.** In a web chat, an Insulin channel, Teams and every job run, the level is what stops a delete. - **Check by asking.** An agent lists the actions it can call at its level; the Actions tab says only Read-only or Mutating. Access levels are one part of an agent’s setup, beside its allowlist, knowledge bases and sharing. To see how Insulin agents get only the systems and tools their work needs, start with [Insulin’s AI agents for business workflows](/agents/). ## Sources Primary sources for the platform rules cited above. Last verified October 23, 2026. Providers change their products, prices and terms without notice — check the source before relying on a detail. - [Fours docs: Integrations, Agent access levels](https://doc.fours.com/integrations/) — Agent access levels: Read-only, Edit or Full picked beside each integration in a custom agent's Integrations list, and the same choice in the built-in Insulin assistant for each integration you connected yourself, AI model providers aside; an integration you never narrow running at Full; Full covering the tools that delete, archive, trash, void or revoke something, and four whose names don't say so (run-query in BigQuery and run-sql in Databricks, which run any SQL statement they are given, merge-contacts in Intercom and cancel-event in Microsoft Outlook); an integration served by its provider's own MCP server, such as Datadog, giving that server's tools instead, which can differ from the list; the Actions tab of an integration's Details marking each action Read-only or Mutating, a Mutating action needing Edit, or Full when it removes something; tools from an MCP server you add yourself judged by their names, one not recognised as a read counting as a change; Fours' own MCP server reached at the Access chosen at connect by an agent you own, and at Edit, which never includes deletes, by an organization agent - [Fours docs: Insulin Agents](https://doc.fours.com/insulin/agents/) — Integrations and Knowledge Bases: Read-only looks things up, Edit also changes records, Full also deletes them; Edit reading, creating and changing records but not deleting them, a delete being anything that takes a record out of that service, including archiving, trashing, voiding or revoking, and a tool that runs arbitrary queries counting as one; Full the default and what an integration selected before the access setting existed keeps; each tool's level taken from the integration's own definition of it, otherwise from its name; Fours' MCP server on an organization agent carrying a fixed Edit badge, reading and changing records but never deleting them, its tools attached only for an organization ADMIN or EDITOR; your own Fours MCP connection's badge showing the access chosen at connect, changed by reconnecting; knowledge bases in Read or Edit mode, Edit never deleting; editing an organization agent's integrations requiring organization administrator access; personal agents private to their owner. What the Insulin assistant may do with your integrations: the pencil and the panel's Integrations section, an integration left alone staying at Full, the levels narrowing Insulin for you alone, a turn run at Read-only when Fours cannot read your levels, and an Inbox CRM action you approve not held to these levels. Asking an agent about its own integrations: listing the actions it may actually call given the integration's access level, each marked read-only or not. Tool Approvals: posting to Slack, and anything not recognized as a read when Insulin is mentioned in a Slack channel, pausing for approval; the card not offered, and the action not held back, in an Insulin channel, a Microsoft Teams DM, a sub-thread reply or a job run - [Fours docs: MCP (Model Context Protocol), Connect Fours' own MCP server](https://doc.fours.com/integrations/mcp/) — The Access level picked on the card at connect, Read only (the default), Read & write (every tool that creates or changes data except deletes) or Read, write & delete; agents showing it as Read-only, Edit or Full, with nothing to change beside it; changing it by disconnecting and connecting again; a connection made before the choice counting as Read only; Access only narrowing the tools on offer, with Fours checking your permissions on every call - [Fours docs: Insulin Slack Bot](https://doc.fours.com/insulin/slack-bot/) — Before You Start: your other connections narrowed one at a time to Read-only, Edit or Full in the Insulin assistant's settings panel, and the bot following those levels as well - [Fours docs: BigQuery integration](https://doc.fours.com/integrations/bigquery/) — BigQuery org-level only; the four tools; run-query passing whatever SQL it is given, statements that change data included, so an agent gets it only with Full; on Read-only or Edit the agent still listing datasets and tables and reading schemas but unable to run a query - [Fours docs: Databricks integration](https://doc.fours.com/integrations/databricks/) — The ten tools; run-sql running whatever statement it is given, including ones that change or drop data, so an agent gets it only with Full; on Read-only or Edit the agent keeping the other nine tools, which only read - [Fours docs: Intercom integration](https://doc.fours.com/integrations/intercom/) — Contacts: create, read, update and delete, plus search and merge (merge-contacts) - [Fours docs: Microsoft Outlook integration](https://doc.fours.com/integrations/microsoft-outlook/) — Outlook connected per user only, with no org-level connection; delete-message deleting a message from the mailbox - [Fours docs: Notion integration](https://doc.fours.com/integrations/notion/) — Pages: create, read, update, duplicate, move and archive pages (archive-page) - [Fours docs: Monday integration](https://doc.fours.com/integrations/monday/) — Item lifecycle: move, archive and delete items (archive-item) - [Fours docs: Google Drive integration](https://doc.fours.com/integrations/google-drive/) — googledrive\_trash\_file moving a file to Trash; googledrive\_unshare\_file revoking a share - [Fours docs: Avalara integration](https://doc.fours.com/integrations/avalara/) — Transaction lifecycle: commit or void an existing transaction (void-transaction) - [Fours docs: Gong integration](https://doc.fours.com/integrations/gong/) — Meetings, library and data privacy: handling GDPR data requests (delete-data-for-email) - [Fours docs: Datadog integration](https://doc.fours.com/integrations/datadog/) — User management: provisioning and disabling Datadog users (create-user, disable-user) - [Fours docs: Insulin Knowledge Bases](https://doc.fours.com/insulin/knowledge-base/) — A deprecated document retired from search but not deleted, its chunks preserved and restorable - [Fours docs: Insulin Inbox, Running a CRM action](https://doc.fours.com/insulin/inbox/) — A CRM action never executed silently: nothing happens until you click Run in chat; a Run limited to the CRM connection the action came from, with other integrations out of reach - [Fours docs: Insulin Jobs](https://doc.fours.com/insulin/jobs/) — A job running as the agent that created it, with that agent's access to resources and integrations - [AWS Well-Architected Generative AI Lens: GENSEC05-BP01 Implement least privilege access and permissions boundaries for agentic workflows](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec05-bp01.html) — Excessive agency, where an agent determines the best solution to a problem is to take broader actions beyond its scope, not inherently malicious but an unintended consequence of automation, the agent having little knowledge beyond the prompt as to what behaviors are permitted; the step to implement user confirmation for the agent - [AWS Well-Architected Agentic AI Lens: AGENTSEC03-BP03 Implement least privilege with dynamic boundaries](https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentsec03-bp03.html) — The desired outcome of agents operating with the minimum permissions required to complete their defined tasks; the anti-pattern of expanding agent permissions in response to access errors without investigating whether the access pattern is legitimate ## Keep reading - [SecurityMCP Server Security: Checks Before You ConnectOct 15, 2026](/blog/mcp-server-security-checks/) - [SecurityRead-Only Access for AI Agents: Where It's SetOct 8, 2026](/blog/read-only-access-for-ai-agents/) - [SecurityWhich Models Serve Insulin Chat and Knowledge Bases?Sep 29, 2026](/blog/which-models-serve-insulin/) - [SecurityBYOK vs Managed Models for Enterprise AIAug 24, 2026](/blog/byok-vs-managed-models-for-enterprise-ai/) [Browse every post on the Insulin Blog](/blog/) ### Stay Updated New posts, product updates and marketplace strategy are shared on LinkedIn as they publish. [Follow Fours on LinkedIn](https://www.linkedin.com/company/suger-inc)