Rules, records and agents. How it holds.

Name the business owner, permitted actions, approval thresholds and escalation path. Review incidents and retire agents that do not earn their operating cost.

Design rule. No autonomous workflow without a named owner and a way to stop new actions.

Reference implementation. An agent register, a decision-rights matrix and an incident playbook. Keep enforceable limits in versioned policy, alongside the approved business policy.

Link model and tool calls, source references, approvals and business changes with a run ID. Track task success, rework, latency and cost per completed outcome. Redact sensitive content and define access and retention.

Design rule. Test model, prompt, retrieval and tool changes against representative cases before release. Investigate production exceptions.

Reference implementation. OpenTelemetry traces, a case-based evaluation set and ERP audit records. Export audit evidence to protected storage when the retention requirement calls for it.

Attach incoming requests and outgoing messages to the relevant business record. Verify the sender and permitted account scope before disclosing order, employee or payment information.

Design rule. A message is a request, not proof of identity or authority. Outbound actions pass policy checks too.

Reference implementation. Frappe communication and CRM, channel adapters and customer or supplier portals.

Present the proposed action, source evidence, applicable rule and expected business effect. Let the reviewer approve, amend or reject, with the decision recorded.

Design rule. Approval applies to a specific action and record version. Material changes require review again.

Reference implementation. Frappe Desk, ERPNext approval workflows and a tailored exception queue where needed.

Give each agent a narrow task and allowlisted tools. Persist workflow state across waits and restarts. Separate model reasoning from code that checks policy and executes actions.

Design rule. Retries can happen. The receiving service must recognise the same operation and prevent duplicate effects.

Reference implementation. A Python worker to start; LangGraph with persistent checkpoints for multi-step agent state. Consider Temporal when long-running recovery across services becomes necessary.

Choose hosted or private models against your data policy and a task-specific evaluation set. Route calls through a gateway with model allowlists, usage limits and controlled logging.

Design rule. A fallback must remain within the same data boundary. A gateway does not make an unapproved provider acceptable.

Reference implementation. A gateway such as LiteLLM; hosted models or private inference chosen through a measured pilot. Private hosting still needs access, retention and network controls.

Assign owners to revenue, margin and service metrics. Publish versioned definitions, dates and dimensions, then expose approved reports or query endpoints to people and agents.

Design rule. Financial amounts come from validated records and business calculations. The model does not invent them.

Reference implementation. Frappe Insights and governed reports first. A shared semantic service and warehouse are options when multiple systems or reporting loads justify them.

Index approved policies, procedures, contracts and decisions with an owner, effective date and access rules. Return source references. Treat retrieved text and attachments as untrusted input.

Design rule. Filter access before context reaches the model. Retrieved instructions cannot grant new tool permissions.

Reference implementation. Frappe Wiki, document storage and the Decision Ledger, with an explicitly implemented retrieval and permission layer. Add a dedicated search index only when needed.

Use APIs, adapters and background jobs. For important events, persist delivery intent with the business transaction, then handle retries, timeouts, failed deliveries and reconciliation.

Design rule. Expect repeated delivery. Use stable operation IDs and deduplicate at the destination; a webhook alone is not a delivery guarantee.

Reference implementation. Frappe APIs and jobs, plus n8n for connector workflows. MCP is an optional tool interface, not an authorisation or reliability layer. Add a broker only for demonstrated fan-out or throughput needs.

Use your identity provider for people and scoped workload credentials for agents. Preserve the initiating user and permitted scope across requests. Manage credentials outside prompts and rotate them.

Design rule. Recheck identity, scope and authority at execution. SSO alone does not grant business permission.

Reference implementation. Your existing identity provider, Frappe roles and scoped service accounts. Keycloak is an option when a separate identity service is needed.

Define data residency, backup ownership, monitoring, patching and recovery objectives. Test restores and document how staff continue critical work while AI services are unavailable.

Design rule. Agree acceptable data loss and recovery time, then test them. Availability targets require an operational design.

Reference implementation. Containers or managed hosting, MariaDB and Redis for the ERP baseline, encrypted backups and a tested recovery runbook. Add replicas and redundant services against agreed recovery targets.