AI Agents for the Enterprise

Enterprise AI agents live or die on governance, not AI capability. Integrating with existing identity, respecting each user's permissions, maintaining audit trails, and routing actions through approval — this is where most of the work is, and where consumer-grade agent thinking fails. This tutorial covers the enterprise concerns, building on multi-tenant and human-in-the-loop foundations.

Identity: the agent acts as the user#

The foundational enterprise principle: an agent operating on behalf of a person has exactly that person's access — no more.

public AgentResult handle(Request request, AuthenticatedUser user) {
    // The agent's tools use the user's credentials/permissions, so it can never
    // do more than the user could do themselves.
    var tools = toolFactory.forUser(user);   // scoped to the user's access
 
    var agent = agentBuilder
            .defaultSystem(SYSTEM)
            .defaultTools(tools)
            .build();
 
    return agent.handle(request.text());
}

Integrating with enterprise systems#

Enterprise systems — SAP, Salesforce, ServiceNow — expose APIs. The agent uses them as tools, with the user's permissions:

@Tool("""
        Look up an opportunity in the CRM by account name.
        Returns opportunities the current user is permitted to see.
        """)
String findOpportunity(String accountName) {
    // Calls Salesforce as the authenticated user — their record visibility
    // applies, so the agent cannot surface records the user cannot see.
    return crm.forUser(currentUser()).findOpportunities(accountName);
}

The integration itself is ordinary API work; the discipline is that it runs as the user, inherits the system's own access controls, and is audited.

Audit trails#

Enterprises must be able to prove what happened. Every agent action is logged immutably:

public void auditAction(AgentAction action, AuthenticatedUser user) {
    // Who, what, why, when, on whose behalf, touching what data — immutable.
    auditLog.record(new AuditEntry(
            action.id(),
            user.id(),                    // who authorized it
            action.description(),         // what was done
            action.reasoning(),           // why the agent chose it
            action.dataAccessed(),        // what data it touched
            action.approvedBy(),          // who approved, if applicable
            Instant.now()));
}

Approval workflows#

Consequential enterprise actions route through the organisation's existing approval processes, not a bespoke agent gate:

public Result requestAction(ProposedAction action, AuthenticatedUser user) {
    if (action.requiresApproval()) {
        // Route into the enterprise's existing workflow — the same approval an
        // employee's action would need. The agent does not invent its own.
        return workflowEngine.submitForApproval(action, user, action.approvers());
    }
    return execute(action, user);
}

Reusing existing approval workflows means the agent's actions are governed the same way human actions are — familiar to approvers, integrated with existing controls. See human-in-the-loop systems.

Data residency and compliance#

Enterprises often have strict requirements on where data lives and how AI may process it — covered in multi-tenant architectures and GenAI on the cloud. An enterprise agent must honor these: route to the required region's models, keep sensitive data in-boundary, and respect the organisation's AI usage policies.

The governance checklist#

Before an enterprise agent touches production systems:

• Acts with the authenticated user's permissions, never a broad service account
• Every action immutably audit-logged with reasoning and authorizer
• Consequential actions routed through existing approval workflows
• Scoped access — only the systems and data the task needs
• Data residency and AI usage policies honored
• Hard budgets and a kill switch (from productionizing agents)
• Injection defenses on all untrusted input
• Tested isolation — an agent for user A cannot access user B's data

The realistic picture#

Enterprise AI agents are less about clever AI and more about disciplined integration with identity, audit and governance. The organisations succeeding with them treat the agent as a new kind of user — authenticated, permissioned, audited, and governed by the same controls as any other actor — rather than as a magical autonomous system that sits outside the rules. That framing is what makes them deployable.

Next#

• Federated learning & privacy-preserving AI
• AI regulations & compliance
• Open source vs proprietary AI strategy