How to Connect CRM, Slack, and Docs in One AI Workspace

Connect CRM, Slack, and docs in one AI workspace

Your AE opens four tabs before every customer call: Salesforce for stage and owner, Gmail for the last thread with the champion, Slack for the internal pricing debate, and Google Drive for the mutual action plan. Each system has a piece of the truth. None of them answers "what should I know about Acme before I dial?" in one pass.

That is the problem this guide solves. To connect CRM, Slack, and docs in one AI workspace, you need more than another chatbot with a Zapier trigger. You need a unified GTM data layer — typed connectors, shared identity across systems, graph bridges that link records, and agents that retrieve live context with citations. Gyri is built around that pattern. This how-to walks through the rollout shape RevOps and IT can run in a few focused sprints, without copying your entire company into a warehouse.

If you want the conceptual framing first, see Federated Search for Business AI. This article is the wiring guide.

Source inventory: map where truth actually lives

Before OAuth flows or connector configs, inventory what each GTM role needs at query time. The goal is not "connect everything." It is connecting the sources that answer real operator questions.

CRM: system of record for accounts and pipeline

CRM holds authoritative identity: company name, domain, deal stage, owner, close date, and the custom fields RevOps added last quarter. Gyri ships native graph modules for Pipedrive and Insightly today, with HubSpot and Salesforce on the same native connector roadmap. Each CRM connector provisions an HTTP endpoint on the workspace graph (metadata.executor: gyri_kb_api) so agents query live API data — not a stale nightly export.

Inventory questions:

• Which objects are authoritative: opportunities, contacts, organizations, activities, notes?
• What custom fields do reps actually reference on calls?
• Who owns CRM hygiene when a connector goes live?

Email: commitments CRM never sees

Gmail and Outlook carry verbal yeses, pricing pushback, intro threads to economic buyers, and security questionnaire replies. For Google Workspace, Gyri supports both per-user OAuth (reps link their own mailbox) and domain-wide delegation (IT provisions a service account for shared search). Microsoft Graph covers the same surface for M365 tenants.

Email is often the highest-signal source for pre-call prep — and the easiest to under-scope if you only connect CRM.

Slack: where context lives before it becomes a doc

Deal blockers surface in #deal-acme. Competitive mentions land in #competitive-intel. CS escalations get forwarded in DMs long before anyone updates the account plan. Slack connects via workspace OAuth (SLACK_WORKSPACE_CLIENT_ID / SLACK_WORKSPACE_CLIENT_SECRET on the Gyri deployment). Tokens can be stored per user or shared at workspace scope depending on your access model.

Inventory questions:

• Which channels are deal-relevant vs noise?
• Do channel naming conventions encode account identity (#customer-acme)?
• Who approves workspace-level vs per-user Slack linking?

Docs: playbooks, MAPs, and security artifacts

Google Drive, Notion, and Confluence hold mutual action plans, battlecards, and questionnaire responses. Drive connects through the same Google Workspace surface as Gmail. Notion is a planned native connector; until then, many teams ingest key Notion pages as documents or bridge via HTTP patterns.

Support tickets, meeting transcripts (Fireflies), and product analytics add churn context — phase two, after CRM + comms + docs work.

Phase-one checklist: List the ten questions reps ask before calls; mark which system holds each answer; identify identity keys (email domain, CRM account ID, Slack channel name); defer everything else.

OAuth and scopes: least privilege per source

Connector auth is where sales AI integration projects stall. The pattern that works: least-privilege scopes, workspace-scoped storage, and explicit user vs workspace token policies.

CRM API keys

Pipedrive and Insightly use API token intake (target: { kind: "pipedrive_api" } or insightly_api with pod). Provision via Settings → Integrations or POST …/workspace/pipedrive-api/provision / …/insightly-api/provision. Tokens stay in workspace credential storage; agents reach CRM through the graph HTTP connector, not raw API calls from chat.

For HubSpot and Salesforce, plan the same native pattern: OAuth app registration, scoped to read objects your workflows need, with write scopes added only when agents that write back are approved.

Google Workspace

Two paths:

Per-user OAuth — Each rep links Gmail, Calendar, and Drive through browser OAuth flows (/auth/google/workspace/gmail/start, …/drive/start). Scopes are separated per surface (gmail.readonly, drive.readonly, calendar.readonly). Good when search should respect individual mailbox boundaries.

Domain-wide delegation — IT authorizes a service account in Google Admin Console with explicit scopes for Gmail, Calendar, Drive, and optional directory read. Gyri impersonates users (e.g. rep@company.com) for live search. Required scopes must include both read and write variants if agents will send mail or upload files — Google treats calendar.readonly and calendar as separate delegation entries.

Wait 10–15 minutes after changing Admin Console scopes before testing write operations.

Slack

Create a Slack app with SLACK_WORKSPACE_CLIENT_ID and SLACK_WORKSPACE_CLIENT_SECRET. OAuth stores tokens in kb_workspace_slack_oauth keyed by workspace and user. Choose link=user (default) for rep-scoped search or link=workspace for a shared bot token when your security model allows it.

Request scopes aligned to search, not admin: channels:history, groups:history, im:history, mpim:history, users:read — adjust for private channels your GTM team actually uses.

Microsoft Graph

For Outlook + OneDrive + SharePoint tenants, register a Microsoft Graph app (connectorKind: microsoft_graph). Same graph-integrated pattern as Google: HTTP endpoint on the workspace, operations via callWorkspaceHttpOperation.

Security principles

• Enforce at source. Federation queries with the user's credentials; permissions live in CRM, Gmail, and Slack — not in a shadow index that might over-expose data.
• Separate read and write. Connect read scopes first; add write scopes when write-back workflows pass review.
• Document token ownership. RevOps should know which integrations are per-user vs workspace-wide before audit season.

Graph bridges: link records across systems

Connecting sources gets data into the workspace. Graph bridges tell the system how records relate — so one GraphQL hop reaches email, Slack, and docs from a CRM account instead of three separate searches.

Why bridges matter

Without bridges, every agent question re-runs keyword search from scratch: find the account, guess the domain, search Gmail, search Slack, hope filenames match. With bridges, a workspaceCustomRecord for an opportunity carries pre-declared edges:

• index_search — query template from body.domain or body.company → related emails, docs, prior insights
• http_operation — live CRM fetch for fresh stage and activity
• graph_edge — typed link to contacts, organizations, or custom types

Agents traverse one hop: workspaceCustomRecord → bridges → hits. That is the operational difference between a search portal and a knowledge graph for companies — vectors find similar text; graphs follow relationships.

Declare bridges with upsertWorkspaceGraphBridge on the anchor type: index_search for federated keyword queries from body.domain, http_operation for live CRM reads, graph_edge for typed record hops. Bridges are declarative — RevOps tunes templates without redeploying agents.

Bridges fail silently when identity keys disagree across systems. Document email domain, CRM account ID, and Slack channel naming conventions in your source inventory before wiring edges.

Test queries: prove the stack before agents

Do not launch agents on day one. Run test queries that mirror real rep questions and verify citations resolve to source records.

Level 1: Federated keyword search

Use keyword_search with sourceTypes scoped to connected systems:

```

sourceTypes: ["email", "document", "slack_message", "insight"]

query: "Acme pricing objection"

liveSearch: true

googleWorkspaceUserId: "ae@company.com"

```

Pass criteria:

• Results include CRM-adjacent comms, not just random #general chatter
• Each hit has a stable record ID for citation hydration
• Live search returns threads from the last 48 hours (freshness check)

Level 2: CRM graph traversal

Query the native CRM module directly:

```graphql

query DealContext($id: ID!) {

workspaceCustomRecord(id: $id) {

id

typeKey

body

bridges {

edgeKind

hits { id typeKey snippet }

}

}

}

```

Pass criteria:

• Opportunity loads with correct stage and owner
• Bridges return email and doc hits tied to the account domain
• No bridge returns hits from unrelated accounts (identity leak)

Level 3: End-to-end synthesis

Ask the workspace agent a pre-call question: "What should I know about Acme before tomorrow's renewal call?"

Pass criteria:

• Answer cites CRM stage, at least one email thread, and one Slack or doc source
• Claims without evidence are flagged or omitted — see AI Answers With Citations
• Response time is acceptable for live use (< 30 seconds for a brief)

Level 4: MCP agent access

Connect Claude Desktop or Cursor to the workspace MCP endpoint and run the same question. Pass if the agent uses federated search before guessing and output matches the web UI synthesis. Document passing queries as regression fixtures.

Common failures and how to fix them

Most AI workspace setup problems are auth, identity, or scope — not model quality.

Google DWD: unauthorized_client on search

Admin Console has write scopes but not read scopes. Google treats drive.readonly and drive as separate delegation entries. Add the readonly scope, wait 15 minutes, retry keyword_search with liveSearch: true.

Slack returns nothing for deal channels

Token is user-scoped but the rep was never added to private #deal-acme. Either add the user to the channel, switch to a workspace bot token with channel membership, or accept that private channels require explicit membership.

CRM connects but bridges return empty

Domain field in CRM is blank or stale. Bridge query templates depend on body.domain or body.company. Fix CRM hygiene first; bridges cannot invent identity.

Duplicate accounts fragment search

"Acme Corp" in Insightly and "ACME" in Slack refer to the same customer but keyword search treats them as different. Add a canonical domain field in CRM and normalize bridge templates to prefer domain over display name.

Rate limits during live search

Federated queries hit APIs at ask time. If reps spam broad searches, Pipedrive or Gmail throttles. Mitigations: cache recent bridge hits on the record, debounce agent search loops, and scope sourceTypes narrowly.

HubSpot / Salesforce not yet native

Connect Slack, Gmail, and Drive first; add CRM via HTTP connector patterns until native HubSpot/Salesforce modules ship.

Agents hallucinate despite good search

Tighten agent prompts to require evidence refs, and pilot pre-call brief workflows where citation format is templated.

Ops maintenance: keep the layer honest

A unified GTM data layer is not install-and-forget. Plan lightweight recurring checks:

• Weekly: Re-run test queries on one live account; check connector status in Settings → Integrations
• Monthly: Audit OAuth token freshness (expired Slack or Google refresh tokens break search silently); confirm new CRM custom fields appear in bridge templates
• Quarterly: Revisit source inventory as tools change; measure whether reps use cited briefs; expand write-back workflows only after read federation is stable

When someone leaves, per-user OAuth tokens need revocation. Document which integrations are workspace-scoped vs personal. As you connect MCP for business agents, gate write tools behind approval workflows and audit tool calls.

Rollout sequence: Week 1 — source inventory and identity keys. Week 2 — CRM + Gmail read scopes on one pilot account. Week 3 — Slack, Drive, and graph bridges. Week 4 — test queries plus one workflow (pre-call briefs are highest signal). Expand from there.

When it works, the four-tab ritual disappears: one question returns deal stage, champion email, Slack context, and the MAP — cited. Insights compound across reps and agents share the same graph via MCP.

Ready to wire your stack? Start your free trial and we will walk through connector setup with the test queries that prove it before your reps depend on it.