AI Agents · Architecture
How an AI agent is engineered to be trusted with real work.
An agent is not a model with a prompt. It is software around a model: identity, permissions, narrow tools, grounded retrieval, approvals, logging and cost limits. This page explains each layer and what happens when it fails.
Request path
Ten layers between a question and an answer.
| Layer | What happens | Controls | If it fails |
|---|---|---|---|
| 01 User interaction | A request arrives from WhatsApp, a web page or an internal screen. Size and rate limits apply before anything else. | Input size limits, rate limiting, spam filtering. | The request is refused with a safe message. |
| 02 Identity and authorization | The system works out who is asking and what role and organisation they belong to. This is decided by application code, never by the model. | Role-based access control, tenant isolation (every query is scoped to the organisation), verified phone or sign-in. | Unknown users receive only public information. |
| 03 Agent orchestration | Server code runs the loop: the model proposes a next step, the code checks it is allowed, runs it and feeds the result back. | Maximum steps and time per request, allow-listed actions only. | The loop stops and the request is escalated to a person. |
| 04 Model interaction | The model receives the question, the rules and only the data needed. It returns a structured proposal, not a command to execute. | Data minimisation, structured outputs, choice of hosted or on-premise model, no training on customer data by configuration. | A fallback message; retries with limits; spending caps. |
| 05 Tool calling | Each tool does one narrow thing with a declared schema and permission. Parameters are validated by code before the tool runs. | Tool allow-lists, read-only by default, per-tool permissions and rate limits. | Tool errors are reported honestly rather than hidden. |
| 06 Retrieval-augmented generation | For questions about documents, the system retrieves the passages the person may read and the model answers only from them, citing sources. | Permission-aware retrieval, citations, a minimum-relevance threshold. | If nothing relevant is found, the agent says it does not know. |
| 07 Business system integrations | Tools reach your CRM, ERP, database or APIs through service accounts with the least privilege that works. | Read replicas or read-only roles where possible, encryption in transit, secrets kept out of prompts. | The agent reports the system is unavailable and offers a handover. |
| 08 Logging and monitoring | Every request, tool call, approval and refusal is recorded. Dashboards track failures, latency and cost. | Audit logs, minimised personal data in logs, alerts on error spikes and cost anomalies, retention controls. | Alerts reach the owner; the agent can be switched off. |
| 09 Human review | Sensitive actions are queued for approval. A sample of resolved conversations is reviewed, and feedback improves the agent. | Approval queues, sampling, escalation with full context. | Work waits for a person rather than proceeding unsafely. |
| 10 Error handling and cost control | Timeouts, retries with back-off and circuit breakers stop one failure becoming many. Budgets cap usage. | Daily usage limits, a kill switch, regression tests on real past requests before each change. | Degrades to “a person will reply” instead of guessing. |
Controls
What keeps it safe.
Role-based access control
What a person may see or do decides what the agent may see or do on their behalf.
Tenant isolation
One organisation’s data is never retrievable in another’s conversation. Enforced in code and queries.
Data minimisation
Only the fields needed for the task are sent to the model.
Encryption
Encrypted in transit. Encrypted storage is used where the hosting platform provides it; we confirm the specifics for each deployment.
Audit logs
Who asked what, which tools ran, what was approved or refused.
Prompt-injection defences
Text inside documents, emails or messages is treated as data, never as instructions. Tools are allow-listed, outputs are validated, and sensitive actions need approval regardless of what the text says.
Sensitive-action approvals
Anything that changes a record, contacts a customer or touches money waits for a person.
Reliability monitoring
Error rates, latency and unanswered questions are watched.
Usage cost controls
Per-day and per-user budgets and alerts.
Evaluation and testing
A fixed set of real past requests is re-run before each change to catch regressions.
Retention controls
Conversation and log retention follow your policy and local rules.
Honest limits
What we do not claim.
- Agents are not error-free. They will sometimes be wrong, escalate when they need not, or fail; the design assumes this and keeps people able to catch and correct it.
- Agents are not fully autonomous. Sensitive actions require a person, and anything the agent cannot do safely is handed over.
- No system is guaranteed secure. We reduce risk with layered controls, testing and monitoring, and we say what each control does and does not cover.
- We do not currently advertise compliance certifications on this site. If we list one, it will be one that has been independently verified.
- Where you need health or financial data to stay on site, we can deploy models on-premise. Odontofusion OS already runs a dental-trained AI offline.
What an agent can touch in each system See the checks in a guided demo Ask an engineer