Where this is going
The first wave of business AI was a box you type into. It was useful, and it was limited in a predictable way: the model knew a great deal about the world and almost nothing about your company, so a person had to carry context to it every single time.
The second wave is agents that hold the context themselves because they live where the records are. Once that is true, the interesting question stops being what a model knows and becomes what an agent is allowed to do.
That is why we think the shape of business software is about to change rather than improve. A system designed around agents has fewer screens, not better ones. Work arrives as a decision with its evidence attached, and the human contribution is approving, declining or correcting it with a reason. The direction of travel is the fewest possible tabs and buttons.
Between businesses
Inside one company, agents are an efficiency story. Between companies, they are something larger.
Every business will have a top-level agent that represents it to the outside: one that can be asked for availability, quote a price inside a floor, commit a delivery window and sign what it agreed to. When both sides of a transaction have one, the asking collapses. An enquiry that takes three days of phone calls takes minutes, and both firms hold the same record of what was promised.
- 01: A buyer’s agent asks for a grade, a quantity and a window.
- 02: Your agent checks stock, committed load and your floor price.
- 03: It answers, or escalates to you if the value is above your threshold.
- 04: Both sides countersign, and hold the same record of the commitment.
Two things make this safe rather than alarming. The first is tiering: an unknown agent can ask a question and get an honest, non-binding answer, and nothing it sends can bind your business. Only a counterparty you have a contract with can receive a binding commitment, and only one you have granted a mandate to can commit money, within a limit and an expiry you can revoke.
The second is that the protocol is not ours. Agent-to-agent exchange is being standardised in public, and we would rather apply a standard that large platforms already support than invent one and ask an industry to adopt it.
This is a direction we are building towards, not a capability Zelleo is claiming today.
The roster
Inside the business, agents mirror roles rather than objects. One agent per object collapses at twelve thousand part numbers; one agent for the whole company cannot be given sensible permissions. Role agents sit where permissions, evaluation and accountability already line up with how the company works.
| Agent | What it owns | May act alone | Escalates when |
|---|---|---|---|
| Allocator | Which supplier or site a requirement goes to | Reserve and release stock, quote above your floor | A price falls below the floor, or a credit limit trips |
| Promiser | The delivery window it will defend, and its uncertainty | Commit a window inside its calibrated band | The band is wider than you can tolerate |
| Planner | Keeping the schedule feasible | Propose a sequence, flag a shortage | A work order would be committed, or overtime is involved |
| Expediter | Commitments drifting towards breach | Re-route, reassign a vehicle, warn a counterparty | A breach is certain, or a penalty clause triggers |
| Concierge | Questions, drafts and document bundles | Answer, draft, assemble, translate | A request would need it to act rather than explain |
| Steward | The other five | Nothing on the business itself | Always: it reports, it does not decide |
Each agent can read only what the human role it mirrors can read, enforced when data is fetched rather than by instruction. If two agents disagree, it goes to a person: disagreement is rare, specific, and usually a real business tension somebody should know about.
When a model provider has an outage, agents fall back to the written rules and say so visibly. A business will forgive “we fell back to your rules and told you”. It will not forgive an error page.
Earning autonomy
Autonomy is set per action and per business, with a value threshold, and it moves in one direction only when the evidence supports it.
- Manual: A person does it. The system records it.
- Assisted: The system drafts. A person decides.
- Semi-automated: The agent proposes. A person approves.
- Highly automated: The agent acts. A person is told and may reverse it.
- Fully autonomous: The agent acts inside a mandate. A person oversees.
Under every rung sit the same three safeguards: a new rule is simulated against the last month of real work before it fires on anything live, a review has a stated timeout, and there is always a named person to hand off to.
An action only moves up a rung when its agreement with human decisions clears a stated bar, with its confidence interval, measured by running it in shadow beside your team. Some actions never move: pricing below the floor, approving overtime, approving a payment or a warranty claim, and sharing data outside the firm are designed to stay with a person permanently.
The measure of whether any of this is working is simple and uncomfortable: the queue of things waiting for a human should get shorter quarter after quarter. A dashboard cannot make that claim about itself.
The five layers
Your systems stay yours. Zelleo reads from them, reasons over one shared model of the business, and changes state only through declared actions, which is what makes the same record serve as the audit trail.
Surfaces: Decide · Oversee · Investigate · Compose
The six products
Agent plane: Role agents, each scoped to a human role’s permissions
Agentic Workforce
Ontology: The only place state changes
Data: objects · links · properties
Logic: rules · models · constraints
Action: the typed verbs
Platform
Ingest: batch · change capture · poll · parse · confirm
Platform
Systems of record: Yours, and you keep them
ERP · Tally or SAP. Stock sheets. Telematics. Messaging and phone. Construction programme
A2A: The firm boundary, where other businesses’ agents talk to yours.
The single architectural decision that cannot be retrofitted is that nothing changes state except through a declared action. That one rule is what makes autonomy auditable and reversible at the same time.
What we believe
People are right to be wary of agents. Most of what has been sold as one is a thin wrapper around someone else’s model, reaching out to data and services the buyer does not control, with a prompt as its only real boundary. A prompt is not a security model.
Our position is that agents become trustworthy through architecture rather than through assurances: built for one business, grown inside infrastructure that business owns, reading only what the role they mirror may read, and acting only through declared actions that can be audited and undone.
Get that right and the fear resolves itself, because the honest answer to “what could this thing do to us?” becomes a list you can read rather than a promise you have to take.