AI/ML engineering · Operations
AI agents for back-office operations
We build AI agents for back-office operations: software that carries out multi-step work such as invoice processing, reconciliation, report assembly and customer file refresh, using your systems through narrowly permissioned tools, with human approval where it matters. Each agent has a defined job, tested behaviour, a full log and a measured result, and you own the agents, the prompts and the code.
Checklist · AI readiness
Enterprise AI readiness and governance checklist
A checklist for enterprises planning machine learning, language model or agent projects: use case, data, hosting, security, evaluation, human oversight, governance, monitoring and cost.- 01Nine areas to settle before a model goes near production.
- 02The security items specific to language models and agents.
- 03Evaluation and monitoring questions that regulators and auditors ask.
- 04Seven questions to put to any vendor or development partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
Process selection and design
Choice of workflows that are frequent, rule-heavy and tolerant of review, with the steps, decisions and exceptions written down before anything is automated. - 02
Agent workflows
State-machine workflows in which model calls handle the judgement steps, and ordinary code handles control flow, so behaviour is predictable and testable. - 03
Tools and system access
Narrow, typed tools for reading and writing in the ERP, ticketing, document and finance systems, each with its own permissions and limits. - 04
Document and email understanding
Reading of invoices, statements, contracts and emails into structured data, with confidence and validation against master data. - 05
Human approval and escalation
Defined approval points by value and risk, a review queue with the agent's reasoning and evidence, and escalation when the agent is unsure. - 06
Memory and context
Access to the right data for each case, such as policies, past decisions and customer history, retrieved with permissions and not copied into prompts wholesale. - 07
Evaluation and regression tests
A test set of real cases with expected outcomes, run on every change to the prompt, model or tool, with results tracked over time. - 08
Guardrails and safety
Checks on inputs and outputs, limits on actions, protection against instructions hidden in documents and a kill switch. - 09
Observability and cost control
Traces of every run, outcome and exception rates, time and cost per case, and alerts when behaviour changes.
Reference architecture.
Standards and interfaces
What we design against.
- OWASP Top 10 for LLM Applications
- Risks including prompt injection, sensitive information disclosure and excessive agency, used as the security checklist for every agent.
- Model Context Protocol and tool interfaces
- Standard ways to expose systems to agents as tools, with schemas, permissions and logging.
- NIST AI Risk Management Framework
- Govern, map, measure and manage functions for the agent life cycle.
- ISO/IEC 42001
- An AI management system standard for governance and accountability, used where an organisation wants a formal framework.
- Segregation of duties and internal control
- Financial control principles applied to agents as they are to staff.
- Data protection law
- Lawful use, minimisation and retention of personal data processed by agents and stored in logs.
Data model
The core entities.
- Case
- The unit of work, its source, data, status, owner and outcome.
- Run and step
- Each workflow step, model call, tool call, input, output, time and cost.
- Tool and permission
- Tool definition, allowed actions, limits, system account and approval requirements.
- Approval
- Reason for review, reviewer, decision, correction and time.
- Evaluation case
- Input, expected outcome, scoring and results by agent version.
- Agent version
- Model, prompts, tools, test results, approval and release date.
- Incident
- Unexpected behaviour, impact, cause, fix and the review that closed it.
When custom development is the right call.
Controls designed in, not added later.
Least privilege
Each tool has its own account with the minimum rights, limits on value and volume, and an owner.Human approval for risk
Actions above defined value or risk wait for a person, who sees the reasoning and the evidence.Injection defences
Content from documents and emails is treated as untrusted, and cannot change the agent's instructions or permissions.Complete logging
Every model call, tool call and decision is recorded with inputs and outputs, with personal data protected.Containment
Rate limits, spending limits and a kill switch for each agent, tested regularly.
From discovery to a system you run.
- 01
Process and risk assessment
We choose a first process with the business owner, write down its steps and exceptions, and agree what the agent may and may not do. - 02
Evaluation set and design
A set of real past cases is assembled with correct outcomes, and the workflow, tools and approval points are designed against it. - 03
Build and test offline
The agent is built and tested on the evaluation set until it meets the agreed standard on each type of case. - 04
Shadow and assisted mode
The agent processes live cases without acting, then proposes actions for people to approve, with measurement of agreement. - 05
Selective autonomy
Case types that meet the standard run without approval within limits, and the rest stay with people, reviewed regularly.
Relevant work
Where to see our work.
Common questions.
- What is an AI agent, as opposed to automation?
- Traditional automation follows fixed rules. An agent uses a model to interpret messy inputs and decide among steps, while ordinary code controls the workflow and limits. The combination handles documents and exceptions that rules alone cannot.
- How do you make sure an agent does not do harm?
- By limiting what it can do, not what it says: narrow permissions, value limits, human approval for risk, defences against injected instructions, full logs and a kill switch. Behaviour is tested against real cases on every change.
- Which processes are good first candidates?
- Frequent, rule-heavy processes with clear outcomes and a review step, such as invoice matching, statement reconciliation, report assembly and file refreshes.
- How do we measure the result?
- By comparing the agent's outcomes with the correct ones on the evaluation set, then in production by agreement with reviewers, exception rate, time per case and cost.
- Who owns the agents and code?
- You do. The agents, the prompts, the tools, the evaluation sets and the code stay yours.