Type: Connector disposition
Subject: Clay
Decision requested: Approve the proposed disposition for Clay across its 5 assessed actions
Inherent / residual: High / Moderate
Control owner: Claude Owner / Primary Owner + Clay Workspace Admin
Context: 5 assessed actions. Runtime settings proposed: Needs Approval x5. Class: Remote MCP server (third-party, vendor-hosted). Control point: Claude tool permission + Clay workspace admin (MCP membership, credit limits, Functions). Control owner: Claude Owner / Primary Owner + Clay Workspace Admin.
Risks: R-22 [High inherent / High residual] Acquisition of third-party personal data without an assessed lawful basis | R-23 [Moderate inherent / Low residual] Credit metering as financial exposure, with no direct connection revocation | R-24 [Moderate inherent / Moderate residual] Capability ambiguity between read-only querying and Function-driven writes | R-27 [Critical inherent / High residual] Aggregate outbound surface across the estate
Open verification: V-17 [High] Clay MCP membership, the default and per-user credit limits, the inventory of Functions toggled 'Enable for MCP', and the state of the 'Allow querying all accounts' toggle. | V-18 [High] Whether a documented lawful-basis and privacy assessment exists for third-party prospect data acquisition and enrichment.
Ruling:
Amendment or condition: