One system for the whole trade cycle, and an AI layer that cannot touch money alone

Before any AI, the business needed one place where its operations actually live. Inventory, sales orders, purchase orders, customer credit, supplier terms, and the accounts that tie it together. One system, one set of rules, one set of permissions defining who may do what.

That order matters. An agent layer is only as trustworthy as the system underneath it. Permissions, roles and an audit trail were built for people first, so the AI layer could inherit them instead of inventing its own.

The agent layer exposes 100+ tools over MCP. Every tool works through the same rules and permissions a person would. There is no separate back door for the AI.

That one decision does most of the security work. An agent cannot see data a person in the same role could not see, and cannot take an action a person in the same role could not take.

An approval queue for agent actions went in from February 2026. Every action is classified by risk before it runs. Reading data or drafting a quote is low risk and just happens. 34 tools are classified high risk, and anything that moves money or cannot be undone stops and waits for a person to say yes.

The system never judges danger on the fly. It checks a list. Any tool that mutates data and was never classified fails closed and needs approval anyway. Boring beats clever when the thing being gated is money.

“Human in the loop” turned out to be two different mechanisms. When no one is watching, an agent running on a schedule queues the action durably and waits. When a person is already in the conversation, a blocking queue is absurd, so from June 2026 the tool refuses the first call and hands back a short-lived token bound to a fingerprint of the exact arguments. Same arguments, it runs. One digit different, the token is void. It expires after 300 seconds.

Swap the two mechanisms and both collapse. An unattended agent with a confirmation token just confirms itself. The system needs both, each in its place.

The system is operated by the person who built it. When something breaks, the person who answers is the person who wrote the code.