ECI-SRV-15
AI Agents and Integration with Business Systems
A language model does not read your directory, does not query your database and does not open a ticket. It has to be connected to them, and every connection opens an access path. We build those connections on open protocols, with least privilege, a log of every call and human approval before any action.
Scope of work
- Inventory of the systems to be connected and the actions actually expected on each.
- Connections built on an open protocol, one connector per system.
- Dedicated service accounts, minimal access scope and secret rotation.
- Logging of every call: caller, parameters, result and timestamp.
- Review of the risks specific to agents: instructions injected through a document that is read, a diverted tool description, excessive access scope.
Deliverables
- Connectors deployed and documented, with the exact list of actions exposed.
- Rights matrix: for each connector, the scope granted and its justification.
- Searchable audit log, retained for the period agreed with you.
- Risk review note and procedure for withdrawing a connector from service.
Technologies
- Open tool connection protocols, deployed as containers on your own infrastructure.
- Service accounts and access scopes managed with FreeIPA, Kerberos and your existing directories.
- Audit log collected by Loki and queried in Grafana.
Three levels of connection
| Level | What the agent may do | Condition |
|---|---|---|
| Read only | Query data, with no effect on the system | Scope limited to the agreed repositories |
| Validated write | Prepare an action, carried out after explicit human approval | Request and approval recorded in the log |
| Autonomous write | Act without prior approval | Outside our scope |
Terms
Five to twenty days depending on the number of systems connected and the level chosen for each, fixed price after framing. The engagement covers the connection and how it is secured; it includes neither the choice of model nor the design of the business use cases.
No write connection goes into service without explicit human approval of each action.
How the engagement runs
Phase 1 — Inventory
- Candidate systems, expected actions and the data each one exposes.
- Each action assigned to the connection level that suits it.
Phase 2 — Connection
- One connector deployed per system, with its own dedicated service account.
- Access scope restricted to the retained list of actions alone.
Phase 3 — Control
- Audit log set up, with alerts on refused calls.
- Risk review: documents read, tool descriptions, scopes granted.
Phase 4 — Handover
- Documentation of the connectors, the rights matrix and withdrawal from service.
- Training your teams to read the log and to add a connector.
What every engagement includes
- A detailed quote, issued after framing
- A named project manager
- Operating documentation delivered
- Transfer of skills to your teams
- Work carried out on site or remotely
- Support after go-live
No work in production without a written rollback plan.
Request a framing session
Or contact us directly:
Let us talk about your situation
Every engagement begins with a framing exercise and a detailed quote.
Book an appointment