Putting a language model next to a company’s live records is not technically difficult. Doing it in a way that a finance director will still be comfortable with in eighteen months is a different problem, and it is almost entirely about constraints rather than capability.
Here are the three we built the agent layer around, and what each one cost.
Constraint one: an agent can never exceed the person who asked
Every agent request runs inside the permission context of the user who invoked it. Not a service account, not an elevated integration user, not a role we created for convenience. Yours.
If you cannot open the salary table in the interface, the HR agent cannot read it when you ask, and it will tell you that rather than quietly returning a partial answer. If your role is scoped to one warehouse, the operations agent sees one warehouse.
This sounds obvious and it is the single most commonly violated principle in AI features shipped this year. The reason is that permission-aware retrieval is slower and harder to build than a pre-computed index over everything. An index built once, with elevated access, is fast and easy. It is also a copy of your entire company sitting outside your permission model, and the first serious question any auditor asks is who can read it.
We do not have that index. Which brings us to the second constraint.
Constraint two: nothing is retained
When an agent answers a question, it reads the specific records needed at that moment, produces its answer, and the context is discarded. There is no vector store holding embeddings of your customer list, no cached conversation containing your figures, no fine-tuned model carrying traces of your business.
The engineering cost is real. Every request pays retrieval cost again rather than amortising it. We compensate with narrow, permission-filtered retrieval rather than by keeping things around.
What you get for that cost is a property that is very hard to obtain any other way: your records remain the only copy of your records. When you delete a customer, they are deleted. When an employee exercises a right to erasure, there is no second system holding a shadow. When your retention policy says seven years, it means seven years, not seven years plus whatever an index happens to remember.
It also means the answer to “are you training on our data” is not a policy commitment that could change with a terms update. There is structurally nothing to train on.
Constraint three: agents propose, people approve
By default, no agent takes an action with financial or legal consequence on its own. It drafts the credit note, it prepares the dunning email, it proposes the purchase order, and a person accepts.
This is not timidity about model quality. It is a recognition that the interesting failures are not hallucinations, they are correct-looking actions taken in a context the model could not fully see. The model does not know that this particular customer is mid-dispute, or that the supplier called yesterday, or that the director wants to handle this one personally.
You can loosen the gate for genuinely low-risk work, and some customers do. Every action an agent takes is written to the audit trail with the agent named as the actor, so the question “why did this happen” always has an answer.
Why this is easier for us than for a competitor
There is an architectural advantage here that has nothing to do with cleverness.
Because all the applications share one database, an agent answering a question about a late delivery reads the order, the shipment, the invoice and the support history in one place, under one permission model, in one query path. There is no federation layer, no set of API credentials with different scopes per system, no reconciliation of a customer identity across five products.
A competitor whose suite is six acquired products behind one login has to solve identity, permissions and freshness across all six before their agent can answer the same question. Most of them solve it by building the index we refused to build.
What this looks like when it works
The finance agent notices three invoices drifting past terms, drafts chase emails in the customer’s language referencing the actual open items, and puts them in front of the credit controller. She reads them in ninety seconds, changes one sentence in the one that is politically delicate, and sends all three.
Nothing about that is magic. The interesting part is what did not happen: no export, no mail merge, no second system holding customer contact details, and no copy of the receivables ledger anywhere it should not be.
