Team playbooks
Setting a single team up with governed access, in the order you would actually do it, using the systems that team already runs.
Keep BambooHR salary data out of AI assistants
Two layers keep BambooHR salary data away from Claude and ChatGPT: the access level behind the API key, and an allow rule per role in Elaichi.
Nachi Raman
Keep payroll data in HR with Gusto in Claude
Gusto in Claude runs on Gusto's own MCP server. One admin connects it in Elaichi, HR gets a Gusto-only toolbox, and roles decide who reaches which tool.
Nachi Raman
Intune in Claude for help desk lookups only
Intune in Claude for a help desk is one allow rule, not six blocks: the msintune connector carries 198 tools and only 69 of them read.
Roopendra Talekar
Jamf in Claude on a read-only API role
Jamf in Claude lets a help desk check a Mac's inventory mid-ticket. Build a read-only Jamf API role, then narrow it per person with Elaichi restrictions.
Roopendra Talekar
Set up Bill.com MCP access for ChatGPT, reads only
Set up Bill.com MCP access for ChatGPT so accounts payable can read bills, and never approve one, pay one, or edit vendor bank details.
Nachi Raman
Sentry MCP access for Cursor, without write tools
Sentry MCP access for Cursor, governed: two role restrictions that keep the agent reading issues, and the audit filter that proves it.
Scope Intercom MCP access for support team
Intercom MCP access for support team work: allow conversation reads and replies, block contact deletion and broadcast, and pin one inbox with a frozen value.
Uday Gajavalli
Xero in Claude, without letting it edit invoices
Xero in Claude for a finance team: analysts read invoices and reports, no assistant can edit or void an invoice, and one named person drafts supplier bills.
Uday Gajavalli
Should marketing get HubSpot inside ChatGPT?
Yes: marketing can have HubSpot inside ChatGPT to read contacts and campaigns and draft work, with email sends and deletes restricted and the portal pinned.
Roopendra Talekar
Each rep's own Salesforce access, in ChatGPT
Salesforce access in ChatGPT works per rep: each call runs on the rep's own connection, so Salesforce's sharing rules decide which accounts they see.
Nachi Raman
Ironclad contracts in ChatGPT, signing blocked
Legal reads Ironclad contracts in ChatGPT through Elaichi. The connector has no signing or approval tool, and a role rule blocks launching or cancelling.
Nachi Raman
Let IT post to one Slack channel from Claude
IT can post to one Slack channel from Claude when Elaichi freezes the channel argument. Channel reads stay open, and opening DMs is restricted for the role.
Roopendra Talekar
HR can read Rippling in Claude, not run payroll
HR can read Rippling in Claude through Elaichi: workers, teams and departments. The connector has no payroll-run tool, and one rule keeps HR to reads.
Nachi Raman
Zendesk for support agents, minus bulk deletes
Zendesk for support agents in Claude: let them read and update tickets, block deletes and bulk sends, and give the lead one exception.
Uday Gajavalli
How to roll out Cursor to an engineering team
To roll out Cursor to an engineering team, connect Jira and Slack once, bring GitHub in on Gold, block the deletes per role, then have engineers sign in.
Roopendra Talekar
Which Notion workspace did ChatGPT write to?
Elaichi's audit trail names the Notion workspace each ChatGPT call reached. Pin the connection or database first, and the other workspace is out of reach.
Raajshekhar Rajan
Put AI to work in your own apps
14 days of Black, no credit card. Start with one app and one team.
When the trial ends, nothing is deleted. You move to the free Personal plan, and connections, roles and the audit log stay where they are.
Add one link to your AI app
The same link for everyone on your team.
https://api.elaichi.ai/mcp
ChatGPT
Claude
Cursor
Microsoft Copilot