What changes when the estate has its own rules.

Agents should not re-learn your business on every question. We compile it once, with every fact traceable to its source.

Before an agent goes live, a forward-deployed engineer spends a week with your team building its knowledge: the questions people will actually ask, the documents and systems that answer them, the words your organisation uses and what they mean, and who may see what.

That knowledge becomes a versioned asset your agents query, inside your environment, with a citation on every answer and a date on every fact. It is refreshed as your documents change and as your people ask new questions; a fact that may have gone stale is checked before it is used, never assumed.

A department shares an agent so it stops re-learning the same things. What one person says in private stays private.

An agent belongs to a team, not to an individual. The team's knowledge is shared, so nobody has to tell the agent the same thing twice, and a colleague joining does not start from nothing.

What a person says in their own chat is theirs. It is kept in a private store that is not attached to anyone else's conversation at all, so there is nothing for another person's agent to read. Not a rule the agent is asked to follow: a boundary it cannot reach past.

An enterprise runs on a machine of its own. Nothing of yours shares a process, a network or a database with anyone else.

Every enterprise estate gets a dedicated host with the whole platform on it: the runtime, the meter, the connectors, the knowledge store. Each agent session runs in its own sandboxed container on a private network that can reach only the services we name for it, and it never holds a credential; the host does, and hands the agent an answer, not a key.

The meter cannot be told which estate is speaking; the host asserts it, on every call, from a place the agent cannot reach. Backups are encrypted per estate with a key that is yours to destroy. When an engagement ends, one command removes every store we hold for you and the export you receive first is complete, with the credentials left out.

The same design runs our shared platform for small businesses, tenant by tenant, and the same host image runs on Kubernetes when an estate needs more than one machine.

The watch sees it first, the ticket is worked before anyone opens it, and a fix travels as one signed work order. The agent that writes code cannot release it; the agent that reviews cannot write. Production is never written.

Run. The watch reads the system on a schedule with a display-only user: short dumps, failed updates, IDocs, queues and jobs, and the business backlogs behind them, such as blocked invoices and unbilled deliveries. It groups what it finds into issues, diagnoses each from a playbook your CoE lead can correct, and sends a morning note to the lead and to each process owner. The incident agent works your ServiceNow queue with names, ID numbers and emails masked before it reads a ticket, checks the system read-only, finds how similar tickets were fixed, and drafts the work note or resolution; nothing reaches ServiceNow until the analyst says yes.

Assist. People ask SAP questions in chat and the assistant answers as them, with their own SAP access and inside what their licence covers; an action is drafted and done only on their own yes, under their own user. In a shared conversation it has no one's personal access.

Build. When the answer is a code change, six agents carry it: intake opens the record, refinement writes the specification against the system as it really is with the acceptance tests first, build implements and unit-tests in Dev inside the packages you allow and activates on a named person's words, review runs ATC and sends back what is not clean, release tests it against the original intent on your QA screens and releases the transport only when a named person says so, and the functional lane advises beside them. Every hop is a validated work order on a chained ledger.

Your EarlyWatch report is read on your host with identifying details removed, and every red and yellow finding is classified into the lane that can act on it and tracked until it clears. Before any of this goes live, a replay of your own closed tickets shows how often the agents would have been right. One switch stops every agent and removes its access at once.