AI agents that ask before they act
Agents that complete real work across your systems, with scoped permissions, audit trails and human approval.
- Permissions earned step by step
- Every action logged
- People approve what matters
Where agents earn their keep
Multi-step work where the path changes each time. If the path never changes, a workflow is cheaper.
Customer support
Look up the order, apply the policy, resolve what is allowed and escalate the rest.
Finance operations
Match invoices, chase overdue payments and prepare reconciliations for review.
Procurement
Check stock and forecasts, compare approved vendors and draft the order.
Sales operations
Research accounts, update the CRM and draft follow-ups for the account owner.
IT and data operations
Triage alerts, gather context and propose a fix for an engineer to accept.
Compliance checks
Collect evidence across systems and flag gaps for a reviewer.
Four levels of permission
An agent starts at level 1 and earns each step up with evidence.
| Level | Name | The agent | For example | Signed off by |
|---|---|---|---|---|
| 1 | Read | Looks up records and reports | Stock for a product | Nobody |
| 2 | Draft | Prepares a change, saves nothing live | A draft purchase order | The requester |
| 3 | Act with approval | Acts once a named person agrees | Confirm the order | The buyer |
| 4 | Act within limits | Acts alone under a set limit | Send a payment reminder | Reviewed afterwards |
A trace anyone can read
Every tool call is logged in plain language, so “why did it do that?” always has an answer, for your team and for your auditors.
Why agent projects get cancelled- Stock is below the reorder point
check_stock("SKU-EXAMPLE") - Demand is rising, per the ML model
get_forecast("SKU-EXAMPLE") - Two approved vendors found
list_vendors("SKU-EXAMPLE") - Draft saved, nothing sent
draft_purchase_order(...) - Waiting for the buyer to approve
request_approval("buyer")
What makes an agent survive production
Scoped identity
Each agent gets its own limited account, never a shared admin key.
MCP connections
One open standard for tools, so changing the model doesn’t mean rebuilding them.
Evaluation sets
Recorded tasks replayed on every change, before anything reaches production.
Spending limits
Caps on tool calls and tokens, with an alert before the budget runs out.
Questions we get asked first
What is agentic AI?
An agent uses a model to plan and carry out a sequence of steps with tools, such as looking up a record, drafting a document or calling an API, and adapts based on what each step returns. A chatbot answers. An agent attempts a task.
What is MCP?
The Model Context Protocol is an open standard for connecting AI applications to tools and data. It lets an agent use the actions you choose to expose in a system, without custom wiring for each model.
Which systems can agents connect to?
Anything with an API or an MCP server, such as ERP, CRM, ticketing tools, document stores and databases. We check what each system exposes before committing to a design.
Are AI agents safe to connect to business systems?
They can be, if treated like a new employee with limited rights. Use a dedicated account, expose only the actions it needs, require approval for anything hard to reverse, log every call and test how it handles malicious text in documents.
Why do AI agent projects fail?
Gartner names escalating costs, unclear business value and inadequate risk controls as the causes behind its forecast. In practice we also look for missing process owners and poor data, which show up long before the model is the limiting factor.
Do we need several agents working together?
Usually not at first. A single agent with well-designed tools is easier to test and to explain. We split work into several agents only when one agent’s tools or instructions become too broad to evaluate.
Which task would you hand over? Let’s test it.
Describe each step, who does it today and what a mistake would cost.
Start the conversation