Insights · AI Agents
How AI Agents Connect to Business Systems Safely
An agent is only useful if it can reach the information and tools your business uses. It is only safe if that reach is carefully limited. Here is how the connection works in a sensible design.
Tools, not open access
An agent does not log into your systems as a person and click around. Engineers define tools: small, named functions such as “get order status” or “list unpaid invoices for a customer”. Each has a schema for its inputs, a permission, and a clear result.
The model never touches your database or API directly. It asks for a tool to be run, and ordinary application code decides whether that is allowed, validates the inputs and performs the call.
Read first, write later
The first version of most agents should only read. Answering questions from live data is valuable and low-risk. Writing, such as updating a CRM field or booking an appointment, is added later, tool by tool, usually behind an approval step until the agent has earned trust.
Money is a separate category. We do not build agents that initiate payments or refunds.
Which systems, and how
Most modern business software exposes an API, which is the cleanest route. Databases can be reached through read-only roles or views. Older or closed systems may offer only exports or no interface at all, which limits what an agent can do. Messaging platforms such as WhatsApp have their own rules, approved templates and fees. The honest answer to “can it connect to X?” is a feasibility check on X’s interface and your licence.
Identity and permissions
The agent acts for a particular person. The system establishes who that is, through a sign-in or a verified phone number, and each tool checks that person’s role. A receptionist asking about a customer’s balance should be refused, and the refusal should not reveal whether the customer owes anything.
In a multi-organisation system, every query is also scoped to the asker’s organisation in code, not by trusting the model.
Grounded answers
When the question is about numbers or records, the answer is built from what the tool returned, and arithmetic is done by code. When it is about documents, the agent retrieves the relevant passages, answers only from them and cites them. If nothing relevant is found, a good agent says so.
Approvals and logs
Actions with consequences, such as messaging a customer, changing a record or sending a draft, are queued for a person. Every request, tool call, approval and refusal is logged, so mistakes can be traced and the agent can be improved.
A practical checklist
- List the five questions or tasks you most want the agent to handle.
- For each, name the system and the data it needs.
- Check the system has an interface and that your licence allows its use.
- Decide who may ask, and what each role may see.
- Decide which actions need approval.
- Test with real past requests, including awkward ones, before launch.
Talk to an engineer
If this is relevant to something you are planning, we are happy to talk it through, with no obligation.
Discuss a project