We gave our small team's management system to AI agents through an MCP connector. Sign-in goes through Microsoft Entra, and there is no website login to fall back on. People log hours and fetch their own certificates and CVs by chatting with the team TimeKeeper bot. A separate admin bot, used only by me, can upload and read anyone's documents. A nightly job copies the documents to SharePoint. I'll show how the permissions are split between the two bots, what broke along the way, and why we built an MCP connector instead of screen automation.