The AI model is not the problem. The problem is what you gave it to read.
In a 2025 survey, the biggest barrier to AI working was not the model. It was the data underneath it. 56% named poor data quality: missing, stale or inconsistent (AI & Data in Marketing Survey, 2025).
Raw data carries no business meaning. The AI reads the values, makes its own guesses about how they fit together, and hands you an answer like it is fact. Where the records do not match, it cannot tell that the customer in your finance system and the one in your sales system are the same person. So it guesses, and you are not guaranteed the same guess twice. And on its own, the model does not limit each person to the data they are allowed to see.
Knowing who is asking is not controlling what they see
A connector signs in as you, and it works with the access that account was granted. You can switch a whole tool on or off, ask to approve it, or deny it, and on Team and Enterprise an admin can lock that down. So yes, there is an identity behind the connection, and there are controls.
But those controls are the whole tool on or off. They are not data aware. They do not know that inside a system one person should see these records and not those.If the access it signs in with can reach a set of data, the model can pull that data. It cannot reliably enforce record-level business permissions after the fact.
Telling the model who is asking does not change that. A prompt or a skill is instructions it reads, not a limit on the data. It can look like it is keeping to the boundary, then drop it when a question is worded in a way that talks it around.
So the boundary you actually care about, who sees which records, has to be enforced in the data, before anything is handed to the model. Tool switches and trust are not that.
Do not underestimate the prompt
The way a question is worded changes what the AI reaches for and what it concludes. Two people asking the same thing in different words can get two different answers. Lead it, even by accident, and it will confidently give you the answer your words pointed at, not the true one.
On raw data with no fixed meaning, the prompt is doing more of the work than you think. That is fine for a search. It is not fine for a number you are about to make a decision on.
What MCP actually does
MCP is the standard that lets an AI reach into a system and use it. That part works, and it is neutral. It handles the connection and the sign-in. What it does not carry is meaning. MCP passes the model whatever the system exposes. Point it at a raw table and it hands over a raw table. It cannot say what that table means. The weakness is never MCP. It is what you point it at.
And reading is not understanding. A field called “accounts” in one platform is not the same as “accounts” in another. One counts every signup. One counts only the people who pay. One still has customers who left over a year ago. The AI sees the same word in two places and treats them as the same thing.
It is not lying to you. It is doing exactly what you asked it to do: reasoning from values whose business meaning it has no independent way of understanding.
What goes wrong when you ask a real question
It double counts a customer who sits in two systems under two spellings. It reads a status marked “closed” that means won in one place and lost in another. It guesses how to match a record here to a record there when the names and emails do not line up. It misreads a business rule, like what counts as high priority, or how you work out revenue. It reads a number that has not updated yet and reports it as current.
It can also miss information that is technically available to it. Large volumes of data compete for attention, and details buried within them do not always influence the answer, even when they should.
You get a clean sentence and a precise figure. Nothing on the surface tells you it was guesswork underneath. You find out when someone challenges the number in a meeting. By then you have made the decision.
The true cost of letting AI read everything
The big AI products that offer MCP charge in one of two ways. A fixed monthly plan that comes with usage limits, or pay as you go, charged by the token. Either way, the cost is driven by one thing: how much the model has to read and write.
That is the part most people miss. When you point the model at your raw systems, every question makes it pull data in and process it. On a pay-as-you-go plan you pay for all of it, every time. On a fixed plan you burn through your usage allowance faster and hit the limit sooner. There is no version where reading more data is free.
A typical small business runs dozens of separate applications across the company. Point AI at all of that raw and the amount it has to read to answer even a simple question climbs fast, and so does the cost.
Caching the parts that do not change helps. But raw data pulled fresh for each new question is exactly the kind that does not cache well. So the real cost tracks the size of what the model has to read, not how hard the question is. And it is unpredictable, because it moves with your data, not with a price you agreed up front.
Ask the same question twice and you can get two answers
Start with the model itself. AI models are probabilistic. Ask the exact same question, word for word, and you are not guaranteed the same answer. Even set to be as fixed as possible, the output can still move, because of how the model runs. It is not a switch you can simply turn off.
Now add fragmented data on top. The model has to infer meaning each time it answers, which means it does not necessarily arrive at the same interpretation twice. A table that looked relevant yesterday may be ignored today. A matching rule inferred last week may not be inferred next week.
A better prompt does not fix this. Asking the AI to write your prompt for you does not fix it either. A prompt cannot make a probabilistic model repeat itself, and it cannot line up data that does not match underneath.
Your people cannot catch all of this
Your team is busy. They have a full day and a real job to do. You cannot expect them to stop on every answer and work out whether the AI matched the right records, picked the right field, read a current number or a stale one, or dropped something in a large pile of data. They take the answer and move on, because that is what a busy person does.
So ask the honest questions. Can you keep the cost under control. Can you tell when an answer is wrong. Will your people make real decisions on wrong data, because the AI misread something that was never structured for it to read.
With no data foundation underneath, all of that lands on people who do not have time to check it.
Someone still has to set it all up
The promise is that anyone can just ask. The reality is that pointing AI at raw systems is technical work. Someone has to know which tables matter, how a record in one system maps to a record in another, which fields to trust and which ones nobody uses any more. Someone has to set up the connections and keep them working when the systems change.
Bigger companies do solve this. They enforce permissions in the data and put fixed queries or governed views in front of the model, so the figure does not drift. That usually takes a data team. Most smaller businesses do not have one.
Your marketing manager cannot check whether the AI matched the right tables. Your finance manager cannot see which field it read as revenue. The people who need the answer most are the ones least able to check it.
There is also what gets fed in
It is not only what the AI reads by mistake. If hidden or contradictory instructions are sitting inside the data or documents it reads, the model can treat them as trusted and be steered into doing something you did not intend. It is a documented risk and a prominent category in OWASP’s Top 10 for LLM applications. There are built-in protections that try to catch it, but they are not a guarantee, and connecting to raw or untrusted sources widens the opening.
Working straight off raw sources also means you cannot reliably reproduce a number. Ask again next week and the model may reach it a different way, so you cannot show how last quarter’s figure was worked out, or defend it if someone asks. If you have to stand behind the numbers you report, that is a risk, not a feature.
The fixes people reach for are all in the wrong place
When the answers come back shaky, the instinct is to work on the AI. Write a sharper prompt. Ask the AI to write the prompt for you. Move to a bigger model with a larger context window.
None of that touches the problem. A bigger model still reads the same messy data. A larger window lets it take in more at once, which is more to read and pay for, and it still has no meaning attached. And a better prompt, however it is written, cannot match records that do not line up, cannot refresh data that has not updated, cannot make a probabilistic model repeat itself, and cannot tell you whether the answer it gave you is right.
Every one of these treats a data problem as a prompt problem. The prompt is not where this breaks.
What actually fixes it
The AI does not need more access. It needs better input.
Decide what your business terms mean once. Match the same customer or account across every system. Decide who can see what, and enforce it at the data, not in the prompt. Then give the AI that, instead of the raw tables. Now it does not read raw data at all. It asks for revenue and gets the one agreed figure, already matched up, already limited to what that person is allowed to see. Worked out once. Used for every question after.
There is more than one way to get there. You can build this structure yourself, with a data team and time. You can assemble it from separate tools and keep the joins working. Or you can have it done for you. The first two usually require skills and time that smaller businesses struggle to spare.
This is the problem Qtell was designed to solve
Qtell performs the integration and standardisation work before an AI model is involved. Systems are connected, records are matched across platforms, business definitions are established and access rules are enforced in the data layer. The model works from a structured representation of the business rather than attempting to infer meaning from raw systems each time a question is asked.
So the AI never touches raw rows. It works from data that is cleaned, structured and matched up, with access already set. The figure behind an answer comes from one defined query, not a guess over raw tables, so the same question returns the same figure today and on Friday. The model may word it differently. The number does not move.
Now think about asking from inside Claude
You do not log in to anything new. You ask from inside Claude, or Cowork, or whichever assistant your team already uses.
Rather than reading your raw systems directly, the model queries a structured representation of the business that Qtell maintains, over the same protocol. Definitions, relationships and permissions have already been established before the request is made.
Qtell does not replace Claude. It changes what Claude has to work with. Claude still does the asking and the thinking. It just stops pulling raw tables in to do it. Instead of reading across all your systems for every question, it gets one small, defined result from Qtell. That is far fewer tokens to read for that step, and a faster, steadier answer.
And the result is limited to what the person asking is allowed to see, enforced at the data before it is handed over. Two people allowed to see the same thing get the same figure. Someone who is not allowed to see it does not get it at all. Nobody gets a different number because they opened a different tool.
One question before you wire AI into anything
An AI reading your raw data takes on every inconsistency in it, reads it again for every question, does not limit each person to the records they are allowed to see, and hands the result back to you like it is certain.
So ask yourself this. When your AI gives you a number next week, can you say where it came from, what it counted, who was allowed to see it, and whether it will say the same thing the week after?
If the answer is no, the AI is not the first thing to fix.