A laboratory test using n8n, DeepSeek, and HubSpot demonstrated that restricting a model's write access does not prevent the entire AI system from modifying external data. In the experiment, the model lacked direct HubSpot credentials, but the downstream n8n orchestrator retained write permissions, allowing it to execute unauthorized changes.
The study utilized two synthetic HubSpot deals, LAB-042 and LAB-043. When the model generated a proposal targeting LAB-043 instead of the requested LAB-042, the system executed a PATCH request, modifying the wrong record. This confirms that system-level authority differs from model-level restrictions.
The researcher introduced a deterministic gateway between the model's output and the execution layer. This boundary verified parameters before any external call. With this control in place, the system successfully blocked the mismatched request, preventing the unauthorized modification of the CRM data.
The findings suggest that declaring an AI agent as read-only based solely on model credentials is insufficient for production security. Decision-makers should verify where execution authority resides and ensure that runtime controls exist at the boundary where external actions are triggered.
