---
title: "Scoped API Keys for AI Agents: How to Let Claude Write to Some Things and Not Others"
description: "Giving Claude full admin on your CRM is a footgun. Here's how to issue scoped API keys so AI agents have just the permissions they need — and nothing more."
url: https://unlockedcrm.ai/blog/ai-agent-permissions-insurance-crm-scoped-keys
canonical: https://unlockedcrm.ai/blog/ai-agent-permissions-insurance-crm-scoped-keys
category: "Security"
published: 2026-07-30
updated: 2026-07-30
author: "unLocked Team"
source: unLocked CRM — AI CRM for insurance agents
---

# Scoped API Keys for AI Agents: How to Let Claude Write to Some Things and Not Others

<p>Every "Claude deleted my production database" horror story shares one cause: an agent had broader permissions than it needed. Scoped API keys are the fix.</p>

<h2>The Principle</h2>
<p>Treat every AI agent like a contractor: give it the smallest possible permission set that lets it do its job, with a per-agent key so audit logs are clear.</p>

<h2>Common Scope Patterns in Insurance</h2>
<h3>Read-Only Research Agent</h3>
<p>Scopes: contacts:read, policies:read, commissions:read. Use case: "summarize my book," "find at-risk renewals."</p>

<h3>Outreach Drafting Agent</h3>
<p>Scopes: contacts:read, policies:read, tasks:write, notes:write. Can draft and queue but not actually send messages without a human approval step.</p>

<h3>Renewal Worker</h3>
<p>Scopes: policies:read, tasks:write, opportunities:write. Background agent that monitors renewals and creates work items.</p>

<h3>Full Admin (use sparingly)</h3>
<p>Reserved for one-off cleanup tasks under direct human supervision. Rotate immediately after use.</p>

<h2>Per-User Keys vs Per-Agent Keys</h2>
<p>Per-user keys let you see who triggered what. Per-agent keys let you see what tool did what. Both. Issue both. Audit logs make incident response 10x easier.</p>

<h2>Rotation Hygiene</h2>
<ul>
<li>Rotate keys quarterly minimum</li>
<li>Rotate immediately on any team member departure</li>
<li>Rotate immediately if a key was ever pasted into a chat that wasn't end-to-end encrypted</li>
</ul>

---

Source: [Scoped API Keys for AI Agents: How to Let Claude Write to Some Things and Not Others](https://unlockedcrm.ai/blog/ai-agent-permissions-insurance-crm-scoped-keys) — unLocked CRM, the AI CRM built for insurance agents. Citation permitted with attribution and a link to https://unlockedcrm.ai/blog/ai-agent-permissions-insurance-crm-scoped-keys.