The intelligence layer

The same system, upgraded with a governed AI layer.

The Intelligent Business Operating System (iBOS) is the company's agreed way of setting direction, assigning responsibility, doing the work, making decisions, managing money and risk, measuring performance, solving problems, preserving knowledge and improving over time — with a governed AI layer that drafts, checks and alerts while people decide.

What changed: the operating system gains one new layer — governed AI — and no decision right moves.

See the whole system

01 Channels & people

Carry messages and files in and out.

Hold business state.
02 Orchestration

Detect, route, retry and wait.

Judge or approve.
03 Intelligence — AI

Interpret, draft and flag.

Compute final figures or approve.
04 Governed access

Role-scoped tools under a real person's rights.

Run under a shared admin.
05 System of record

Store, calculate, enforce workflow and log.

Be bypassed.
06 Governance plane

Gates, permissions, kill switch, evaluation.

Be owned by what it constrains.

The commitments

Five commitments the AI layer always obeys.

Not aspirations. Rules the system enforces, whatever tool or model sits behind it.

01 One source of truth

Business state lives in one system of record; everything else is a trigger, a view or a cache.
02 AI proposes, people dispose

Anything affecting money, a contract or a client enters as a draft or proposal — never a finished record.
03 Unattended AI never holds write tools

Automation returns structured output; code validates; only a named person's session may create drafts.
04 Every action is attributable

What triggered it, which evidence, which model, who reviewed, what changed — all recorded.
05 Autonomy is earned, scoped and revocable

Agents start read-only and rise only on evidence, with time-limited grants.

The design rules behind them

Where two rules conflict, the lower number wins.

P1 One tool, one role, zero overlap No capability is implemented in two places.
P2 Single source of truth Business state has exactly one owner and one home.
P3 Deterministic first, AI second Use rules wherever rules suffice.
P4 AI proposes, humans decide Judgment is not authority.
P5 Identity per actor, least privilege Nothing acts anonymously or as a super-user.
P6 Draft by default Creation is cheap; submission is consequential.
P7 Idempotent and replayable A retry must not duplicate money movements.
P8 Evidence-linked A claim without a source is a guess.
P9 Reversible and observable We can see it and we can stop it.
P10 Earned autonomy Trust is built from measured performance.
P11 Graceful degradation The business must run when the AI cannot.

How work moves

Every workflow runs the same seven steps.

One owner per step, and only one step ever calls AI — so any automation can be audited the same way.

The operating loop: seven steps, one owner each

Every workflow runs the same loop, so any automation can be audited, monitored and improved the same way.

1 . Step 1 Detect & normalise

Owner: Automation

An event arrives, is de-duplicated and routed.
2 . Step 2 Interpret

Owner: AI

The only step that calls AI: messy input becomes meaning.
3 . Step 3 Validate

Owner: Code

Schema, references and arithmetic are checked in code.
4 . Step 4 Stage

Owner: Code

A draft or proposal is created, with its evidence.
5 . Step 5 Review

Owner: A named human

A named person decides at the right gate.
6 . Step 6 Commit & log

Owner: The system of record

The record moves through workflow; every action is logged.
7 . Step 7 Learn from the diff

Owner: People + evaluation

Edits and rejections become evaluation data.
Then the next event starts the loop again

Edits and rejections are not wasted: the reason and the diff become evaluation data Blueprint, Figure 2

Two access patterns

Whether a person is in the conversation decides everything.

Two shapes cover the work: one where a person is present, one where AI runs unattended with no tools at all.

	With a person Interactive copilot (A)	Unattended Embedded reasoner (B)
When	A person is in the conversation.	Unattended: an event needs interpretation.
What it writes	Drafts only, under that person's own permissions.	Nothing: context in, structured output out; code validates, then stages the draft.
Strength	Flexible, exploratory, conversational.	Predictable, testable, cheap, resistant to prompt injection.
Risk	Over-broad tool access; a persuasive but wrong analysis.	Schema or rule gaps letting a bad proposal through.

Unattended AI gets no tools on purpose: a supplier's PDF is data, not instructions. Anything arriving from outside is interpreted and checked in code — never obeyed.

Earned autonomy

Autonomy is earned, scoped and revocable.

Agents start read-only and rise a tier only on evidence, under grants that expire.

Autonomy is earned: five tiers, A0 to A4

Agents start read-only and rise only on evidence, under time-limited grants.

A0 . Tier Observe

May: Read, monitor and summarise.

Read-only; no record created.
A1 . Tier Advise

May: Answer with sources.

Advice only; a person still decides.
A2 . Tier Draft

May: Create drafts that enter a review gate.

Flagged as AI-proposed; never a finished record.
A3 . Tier Act internally

May: Tasks, reminders and approved templates, under a time-limited grant.

One grant per action set; it expires.
A4 . Tier Act externally & financially Human only

May: Messages to clients, prices, payments, contracts.

Human only — no agent holds this tier.

A4 — acting externally or financially — stays human only Blueprint, Figure 3

Tools are tiered too

Proposing and doing are kept apart: AI may create a proposal record, never a business record.

Tier	Tool	What it may do	Effect
T0	Read	Read and search within the user's own permissions.	None.
T1	Propose	Create a proposal record only.	Changes no business record.
T2	Command	Not callable by AI: a human approves, deterministic code executes.	Writes business records.
T3	Privileged	Restricted and audited; mostly disabled.	High impact; enabled only where justified.

AI proposes; people dispose.

Approval gates

Who decides, and to what standard.

Every proposal lands at a gate sized to its risk, with the evidence beside it.

Class	Gate	In practice	Standard
1	Low & informational	The person concerned confirms a routine summary.	Logged.
2	Internal operational	A checklist or internal request is signed off.	Named role reviewer; evidence shown.
3	Financial or client-facing	A quotation, an order, a claim, a payment.	Maker is not checker; never approved by silence.
4	Legal & regulatory	A contract, a regulatory submission, a permission change.	Director plus an external licensed professional.

The maker is never the checker
Nothing is approved by silence
Evidence is shown next to every proposal

Trust zones

Five boundaries from untrusted input to human authority.

Every message and file crosses all five before it can touch a record.

Five boundaries between untrusted input and human authority

Everything arriving from outside the company is untrusted text; each boundary has one job, so a failure at one is caught at the next.

Untrusted input

1 . Boundary 1 Authenticate & wrap

Control: Check the sender, de-duplicate, wrap in one envelope.
2 . Boundary 2 Mask & minimise

Control: Tokenise restricted fields; send only the context the task needs.
3 . Boundary 3 Never trust model output

Control: Structured output only; no free text reaches a write path.
4 . Boundary 4 Validate before write

Control: Referential checks, arithmetic and thresholds in code.
5 . Boundary 5 Human authority

Control: Approval, separation of duties, signature, expiry.

Each boundary has one owner and one job Blueprint, Figure 5

Agent rules

One role per agent, and a list of things it must never do.

An agent is a colleague with a job description, its own permissions and its own name in the log.

One role per agent

Each has a written charter and a list of things it must never do.
Forbidden by default

Pricing, promises, payments, permissions and free-form client messages stay human.
One identity per actor

No shared logins; every agent answers for its own actions.

When things go wrong

The business runs when the AI cannot.

Stops, tests, fallbacks and cost discipline — designed before launch and rehearsed after.

The kill switch

Stop one workflow, one agent or all AI — rehearsed, graded and fast.
Evaluation sets

Real cases with the human-corrected answer; every rejection becomes a test.
Graceful degradation

If AI is down the business continues manually; nothing depends on AI to finish.
The cheapest adequate step

Rules first; the smallest model that clears the bar; budgets and caps per workflow.

Spend the least that clears the bar

Rules first, then the smallest model that is accurate enough for the job.

1 Rules and code

Anything deterministic.
2 Small, fast model

Classification at volume.
3 Mid-range model

Extraction, drafting, explanations.
4 Highest-capability model

Rare, high-value reasoning.

Where to start

Find your lowest score first, then add the AI layer.

The intelligence layer lands on an operating system that already works. The diagnostic shows where you stand; the programmes install the rest.

Take the free iBOS Diagnostic See the programmes