LIVE DEMO · INTERACTIVE
Claude on NetSuite: permission simulator
Build the NetSuite role an AI agent such as Claude would sign in with through MCP. Set each record type to None, View, Create, Edit or Full, and see straight away what the agent could read, what it could change, and which requests would be blocked.
1. Build the role
Choose a permission level for each record type. Use the presets to start from a known position.
2. Risk score
3. What the agent could do
Could read
Could change
4. Example requests
What would happen if a user asked the agent to do this, with the role as it stands.
5. Warnings
Scores and warnings are a teaching aid, not a security assessment. Review any real role with your administrator and auditors.
ABOUT THIS DEMO
What this demo shows
When you connect Claude, or another AI client, to NetSuite through the Model Context Protocol (MCP), the agent acts as a NetSuite user. It signs in with a role, and that role's permissions decide what it can see and change. Oracle's guidance for the NetSuite AI Connector Service is to grant MCP access only to the roles that need it, and NetSuite does not allow the Administrator role to be used for MCP. So the real design work is the role.
This simulator lets you build that role and see the effect at once. Each record type gets a level from None to Full. View lets the agent read. Create and Edit let it write. Full also lets it delete. The panel shows what the agent could read and change, how ten everyday requests would be treated, and a simple risk score.
Three risks come up again and again when I design roles for AI agents:
- Vendor bank details. An agent that can edit them can be talked into changing where suppliers are paid, for example by an instruction hidden in an email or PDF it reads. Keep this at None.
- Employees and payroll. These records hold personal data. Leave them out unless the use case truly needs them, and check with your data protection lead.
- Writes with no review. Journals, bills and invoices posted straight to the ledger skip the checks your team relies on. Route them through approval, or let the agent prepare drafts that a person submits.
A good starting point is a dedicated role that reads what it needs, writes very little, and is limited to the subsidiaries it serves. Then widen access one step at a time.
Oracle sources: Associated risks, controls and mitigation strategies, Required features and permissions and the MCP Standard Tools SuiteApp.
Planning to connect AI to NetSuite?
I'll help you decide what the agent should do, then design the role, approvals and audit trail around it, before anything touches live data.