AI & Automation
Enterprise AI agents
An agent that can act inside enterprise systems is a privileged actor. The design work is not the model — it is identity, permissions, approval and the audit trail that makes the whole thing defensible afterwards.
What an agent is, in an enterprise context
An agent is a model given tools and a goal, allowed to decide which tools to call and in what order. That autonomy is the point and also the entire risk surface. In a consumer setting a wrong call is an annoyance; in an ERP it is a posted transaction.
Uncontrolled autonomy is not the default here, and should not be. The useful question is how narrow the boundary can be while still removing real work.
Architecture
- Model
- Chosen for the task. Reasoning quality, latency and cost trade against each other, and the largest model is rarely the right default.
- Tools
- Explicit, typed, individually permissioned functions. A tool is an API contract, not a general capability — "read order status" rather than "query the database".
- Retrieval (RAG)
- Grounding in the organization’s own content, with the retrieval layer enforcing the same access rules as the source system. An index that ignores permissions is a data leak with a search box.
- Identity and authorization
- The agent acts as someone. Whether that is the user, a service identity, or a delegated identity determines what it may do and who is accountable.
- Workflow
- The agent participates in a process with defined states, not an open conversation. State is what makes it resumable and auditable.
- Human approval
- Gates on anything consequential — financial, contractual, customer-facing or irreversible.
- Observability
- Every call, input, output and decision recorded. Without it there is no debugging and no defence.
Controls that matter
- Least privilege. An agent gets the narrowest tool set that completes its task. Convenience permissions become incidents.
- Prompt injection defence. Retrieved content and user input are untrusted. Treat instructions found in data as data, keep tool authorization outside the model’s reach, and never let retrieved text expand what the agent may do.
- Bounded autonomy. Step limits, cost limits, and explicit stop conditions. An agent that can loop will.
- Fallbacks. A defined path when the model is unavailable, uncertain or wrong — usually to a human, sometimes to a deterministic rule.
- Evaluation. A test set of real cases with expected outcomes, run on every change. Without it, prompt edits are guesses.
- Segregation of duties. An agent that both raises and approves is not a control, whatever the policy says.
Where agents genuinely earn their place
- Order and exception triage — classifying, enriching and routing exceptions that currently sit in a shared mailbox.
- Document work — extracting and validating structured data from invoices, packing lists and confirmations, with confidence thresholds and human review.
- Operational question answering — grounded retrieval across ERP, WMS and TMS so a planner stops opening four systems to answer one question.
- Reconciliation — matching across systems and preparing the correction for approval rather than applying it silently.
- Supplier and carrier follow-up — chasing acknowledgements and status against a defined script, escalating rather than improvising.
Common failure modes
- Agent where a rule would do. If the logic is deterministic, a rule is cheaper, faster and testable.
- Permissions inherited from a human superuser. The fastest route to an agent that can do far more than intended.
- Retrieval without access control. Grounding in everything means answering from everything.
- No evaluation set. Changes ship on vibes and regress silently.
- Autonomy scoped by demo rather than by consequence.
- No audit trail — which turns a defensible automation into an unexplainable one the first time it is questioned.
Decision criteria
- Is the task judgement-based, or just undocumented? Undocumented is a rules problem.
- What is the cost of a wrong action, and is it reversible?
- Does clean, permissioned data exist to ground on?
- Who is accountable for the agent’s actions, and can they see what it did?
- Is there a measurable before and after, or only an impression of speed?
Next step
Assess your AI agent opportunity
The first useful question is which decision or queue is consuming capacity, and whether an agent is genuinely the cheapest way to relieve it.