Who Manages the Work When AI Agents Cross Five Business Systems?

A lead arrives in the CRM. The agent reads the account history, opens a support task, updates a project, and drafts a note for finance. Each tool records part of the activity, but no single system explains the whole run.

Operators need a control surface that shows the request, current state, systems touched, pending approvals, and failures. Without it, the team pieces together incidents from five audit logs and a conversation history that may not include background actions.

Shared API credentials erase responsibility. Assign the agent a service identity, an owner, and a stated purpose. Its access should match the job rather than the broad permissions of the person who connected the integration.

A sales follow-up agent does not need payroll data. A finance reconciliation agent does not need permission to publish marketing content. Narrow roles make access reviews and incident response far less confusing.

Persistent work needs explicit states such as queued, running, waiting for approval, blocked, completed, and failed. The agent should not bury a blocker in prose. It should stop at the relevant stage and tell the owner what input or permission it needs.

The state record should include timestamps and the last successful action. Operators can see whether the agent stalled before the CRM update or after it opened the support ticket. That clarity reduces duplicate work and unsafe retries.

Classify actions by consequence. Reading approved records and preparing internal drafts may run without approval. Changing a forecast, sending a customer message, moving money, or accepting a legal term should route to the person who owns the outcome.

The matrix should include timeouts. If an approval sits untouched, the system can remind the owner or escalate to a backup. It should not interpret silence as consent.

An agent log needs more than tool-call records. Capture the source inputs, rule or model version, proposed action, reviewer edits, and final result. That history explains why two similar cases produced different outcomes.

Human intervention also creates training material. A repeated correction may call for a new rule, better context, or a narrower permission. The management layer should help the team improve the system rather than store a graveyard of traces.

Choose a workflow with a clear owner, reversible actions, and visible operating pain. Run the agent with staged actions and review the log each week. Expand access only after the team understands the failure patterns.

A company with weak process discipline will feel that weakness sooner once an agent operates across systems. That signal can help. Use it to fix ownership and rules before adding more agents.