Putting AI agents to work in the back office

The back office is where enterprise AI should be obviously useful and usually is not. The work is repetitive, rule-shaped and document-heavy — read the invoice, find the purchase order, check the price, post the entry — and yet most AI pilots end up as a chat box beside the ERP that nobody opens twice.

The reason is usually the same. The assistant has no hands and no ground truth. It cannot query stock, so it guesses. It cannot post an entry, so a human re-types its answer. It has no memory of what your company actually agreed with this supplier, so its confident paragraph is worth less than a two-line query.

We build agents in the opposite order. First, the tools: a small, explicit set of operations the agent may perform against real systems — look up an outlet, read a document, propose a journal entry, flag an exception. Each tool has a signature, a permission and a log. Then, the boundary: what this agent may touch, on whose behalf, and what it must hand to a human. The model comes last, and is replaceable.

The result looks less like a chatbot and more like a diligent junior employee. Invoice arrives; the agent extracts the header and lines, matches them against the open purchase order, and creates a draft entry with the discrepancies marked. Bank statement arrives; the agent matches against open receivables and produces two lists — settled, and needs a human. Nothing posts unattended until a task has earned that right by being boring for months.

This design has an unglamorous benefit: it fails visibly. A hallucinated total that lands in a draft with a mismatch flag is caught by the same control that catches a typo. A hallucinated total in a chat answer that someone re-types is not caught by anything.

Grounding is the other half. An assistant that answers 'how much of this SKU is in the Da Nang warehouse' should be issuing a query, not recalling training data. Once the agent is inside the system with scoped credentials, that is a straightforward tool call — and the answer is as current as the database.

Data residency decides the deployment shape. Where documents can leave the building, a hosted model is the pragmatic choice. Where they cannot, the same agent runs against a model on your own hardware; the tools, the logs and the approval gates do not change.

Start with one task, with a clear correct answer and a human gate. Measure the exceptions, not the demos. Expand only where the agent has been quietly right for long enough that removing the gate is boring.