I Just Gave Copilot Permission to Delete My Opportunities

A colleague of mine turned on the Sales plugin in Microsoft Copilot the other day and sent me a picture of this awesome button. One toggle, and Copilot is talking to Dynamics.

My first reaction was NOT “cool”. I was instantly ancious😓😦

The button itself is fine. What scares me is what can happen after you click it, because this could bring a lot of new problems to Dynamics. The first one being that a button like this could do harm while trying to do good.

“Clean up my pipeline”

Imagine a salesperson writing this to Copilot:

Clean up my pipeline.

What does that even mean?

To a sales manager, it might mean updating close dates and stages. To an AI with access to Dynamics, it could just as well mean deleting the 10 opportunities that look stale. Both are fair readings. Only one of them leaves you with a pipeline the next morning.

Even though the AI is trying to do good, it can do harm. Right now, AI has a lot of creative freedom, and people seem to trust it with way too much access to important data. Let’s have a look at where the logic for this type of guardrail should sit, in my opinion.

Faster than we can think

When a human deletes data in Dynamics, they have to work for it. Open the view, select the records, click delete, confirm the dialog. Every click is a small chance to think, “wait, is this right?”

AI doesn’t click. It works at API speed. It takes actions faster than our mind can comprehend, with consequences we can’t always predict. By the time you notice something is wrong, it’s too late.

That’s why I think we should talk more about security and governance around AI connected to our CRM systems. Not to stop it, but to know what we are actually switching on.

So I tried it

I asked Microsoft Copilot to delete a dummy contact, just because my first response was to assume the worst.

Microsoft Copilot said no. “Delete is not enabled for entity ‘contact’.” Copilot even told me it wouldn’t look for another way around the block. Even though I tried several ways to trick the prompt. Good boy!!!😆

So Microsoft has actually thought about this. That is good!

But look at what it is allowed to delete: notes, appointments, emails, faxes, letters, phone calls, social activities and tasks. That’s the whole activity history of a customer. Maybe not as scary as losing an account, but try telling a sales rep that every email on their biggest deal is gone…. Well.. It might not go down well.

Microsoft Copilot had an AI level stopping of the action, but Claude directly to dataverse did not. Every agent, connector or MCP server that talks to Dataverse brings its own rules. Or none at all.

What about the trash can?

For years there was no trash can in Dynamics. Deleted meant gone.

Microsoft has fixed part of this. The Dataverse recycle bin went GA in April 2026 and can keep deleted records for up to 30 days. But an admin has to turn it on per environment, and the deleted records eat your storage. My guess is that a lot of environments out there still don’t have it switched on.

There’s one problem. It only works for records deleted after you turned it on. So if you flip the Copilot toggle first and the recycle bin second, you’re too late 😆

Where should the logic live?

That leaves the question I keep coming back to: where should this logic actually live?

Right now it looks like the rule sits in the Copilot tool itself. The tool knows it shouldn’t delete contacts. Dataverse doesn’t care, because as far as Dataverse knows, it’s just me deleting a contact with my own security role.

I will argue the logic belongs in the backend. In Dataverse, next to the security roles. Not in the description of a connector that the next tool might not have.

Security roles answer the question “is this user allowed to delete opportunities?”. They don’t answer “should an AI be allowed to delete 50 opportunities in 10 seconds on behalf of this user?”

What I’d like to see is some logic in Dataverse and security roles that sits on top of the security rols for CRUD operations in Dataverse when AI is working. Maybe AI can’t delete more than X records within 10 seconds. Maybe bulk deletes by AI always need a human to confirm something. We don’t have anything like that today, so until we do, I think we should practice some caution!!!

So should we turn it off?

I’m not saying don’t click the button. I’m saying know what’s behind it before you do. And maybe turn on the recycle bin first 😆

So what do you think? Should this live in Dataverse, in each AI tool, or both? Let me know in the comments.