Enterprise Search & Connectors Best Practices

These are the recurring practices worth building into how your organization sets up, scopes, and maintains Claude's connectors over time.

They apply across every supported source, from Google Drive and Slack to Salesforce and GitHub, whether the connector is first-party or MCP-based.

How to Use This List

• Treat these as defaults to apply to every connector, not a one-time setup exercise for the first one.
• Where a practice conflicts with convenience, favor the practice; scope decisions are much easier to get right at setup than to fix later.
• Revisit this list when adding a new connector type for the first time, since some practices matter more for certain sources than others.
• Pair this list with the more detailed rollout checklist when actually executing a team-wide rollout.

A - Scoping

• Grant the narrowest scope that satisfies the actual need. Start from what the requesting team needs answered, not from the widest access the tool offers.
• Document every scope decision in writing. A scope that only exists in someone's memory cannot be audited or handed off later.
• Treat scope as a trade-off, not a pure security setting. A scope that is too narrow makes Claude less useful; the goal is the narrowest scope that still covers the real need, not the narrowest scope possible.
• Re-scope after major changes to the underlying tool. Reorganized Drive folders, renamed Slack channels, or restructured Notion workspaces can silently shift what a documented scope actually covers.

B - Ownership and Accountability

• Assign a named owner to every connector, not a team name. A specific, reachable person is accountable for reviewing and responding to issues with that connector's scope.
• Set a review cadence at the same time you set the scope. A scope decision without a revisit date tends to become permanent by default, whether or not it should be.
• Know whether each connector is first-party or MCP-based. First-party connectors are built and maintained by Anthropic; MCP-based connectors use the open Model Context Protocol and may be maintained by a vendor or third party, which changes who to contact when something needs fixing.
• Reassign ownership explicitly when it changes. An unowned connector is a connector nobody is checking.

C - Rollout Discipline

• Audit scope before enabling a connector broadly. Auditing after rollout means any overexposure was already live for the whole team.
• Pilot with a small group before a full team rollout. Real usage surfaces scope gaps that a paper review alone tends to miss.
• Communicate scope to users before they rely on a connector. Users should know what a connector can and cannot search, rather than discovering the boundary through trial and error.
• Treat rollout as a distinct, deliberate step, not an automatic follow-on from a successful pilot. A good pilot result is a reason to proceed, not a reason to skip the remaining checks.

D - Trust and Verification

• Use citations to verify, not just to skim. A citation exists specifically so an answer can be traced back to its source; open the source for anything consequential.
• Treat a missing citation as a signal, not a gap to ignore. No citation on a topic can mean the relevant content sits outside the connector's scope, which is worth checking rather than assuming Claude searched everything.
• Remember that a citation reflects the source at query time. For anything time-sensitive, confirm the underlying document has not changed since it was cited.
• Watch for scope creep over time. A connector's actual access can grow beyond its documented scope through changes made directly in the source tool, so periodic audits should check for this specifically.

E - Maintenance Over Time

• Review every connector on its set cadence, not just when something looks wrong. Scope drift happens quietly, through the connected tool's normal evolution, not through obvious failures.
• Disable connectors that no longer serve an active need. An unused connector with a live scope is unnecessary exposure with no offsetting benefit.
• Keep documentation current as scopes change. An outdated written scope record defeats the purpose of documenting it in the first place.
• Revisit the connector list itself periodically. New first-party and MCP-based connectors continue to become available, so the right set of connected sources for your team can change over time.

FAQs

Related

• Understanding Connector Permission Scopes and Data Access - the deeper mechanics behind the scoping practices above.
• Connector Rollout Checklist for IT Admins - a concrete, ordered process for putting these practices into action.
• How Claude Cites Internal Sources in Answers - more on the citation-verification practices in section D.
• Enterprise Search & Connectors Basics - a starting point before applying these practices.

Stack versions: Written against the Claude model lineup current as of ~June 2026 - Claude Fable 5, Claude Opus 4.8, Claude Sonnet 5 (the default), and Claude Haiku 4.5. Model names, pricing, and product features move quickly - verify current specifics at platform.claude.com/docs before relying on them.