How an AI Agent Uses Multiple Systems Without Centralizing All Data
Design source-based agent access with tool contracts, identity propagation, least privilege, task retrieval, audit, and minimal retention.
An AI agent can work with CRM, ERP, document repositories, and ticketing without copying all data into one central store. A suitable architecture accesses sources through schema-defined tools or APIs with explicit identity and policy, retrieves the minimum data for the current case, and sends actions back to the system that owns the record.
Avoiding centralization does not remove the orchestration layer. The organization still needs a tool catalog, identity mapping, policy enforcement, audit events, and short-lived working context. What it should avoid is a broad, stale, ownerless copy accessed by a high-privilege agent credential.
Principle
Bring the question to the data
Source systems continue to govern records, permissions, and lifecycle.
Each system exposes business tools such as get_customer_summary, list_open_invoices, find_contract_clause, or create_follow_up_task. A tool returns necessary fields, provenance, timestamp, and reference ID rather than dumping an entire table or document. Queries are constrained by tenant, user, purpose, and case.
The agent selects tools, while a gateway authenticates identity, verifies scope, validates parameters, and filters output. Read-only retrieval remains separate from writes. Sensitive results may be tokenized, redacted, or summarized before entering context.
