Safe by design.
Handley starts read-only, drafts everything, and acts only when a person approves. And the rules that matter are not written in prompts - they are built into Business Central itself.
Autonomy is a ladder, not a switch.
Every agent works on the same four levels, and the level is set per task, per value, per agent - by you.
0
Read and advise
Query, analyse, recommend. Nothing in your system changes.
1
Act on the routine
Small, reversible, rules-based work runs without a person - and every action is logged with its reason and evidence.
2
Propose; you approve
The agent prepares the complete transaction. A named person approves before anything posts or sends.
3
Human-led
For the big calls - payments, credit limits, write-offs, statutory lodgement - the agent assembles the evidence and a person acts.
Every agent starts at “propose”. Autonomy is earned through a 60-day shadow run, measured continuously, and can be wound back at any time.
Enforced in the system, not the prompt.
A guardrail written into an agent’s instructions is a statement of intent. A permission set is a control. Everything that must never happen is denied structurally, inside Business Central.
No agent writes bank details
No agent can create or change a bank account number on any record - ever. That is human-only, with out-of-band verification. Invoice-redirection fraud is the biggest loss vector in finance, and it is closed structurally.
The preparer never releases
Jade prepares payment runs and cannot release them or touch the vendor master. A person creates vendors; a person releases payments. No exceptions, and no “urgent” bypass.
An independent eye on cash
Riley reconciles the bank but cannot move money. That makes the reconciliation a genuine detective control over the payment cycle, not a convenience.
Sales never approves credit
The agent that earns the revenue cannot accept the credit risk. Quinn prepares the case, Ava assesses it, a person approves the limit.
No self-approval
No agent approves its own work, or work it initiated through another agent. Maker and checker are always separate.
Our design rule: if a prompt were the only thing preventing something catastrophic, the design would be wrong. So it never is.
Who does whatThe connection model.
1
Read-only first
Each agent connects in your own Microsoft tenant as a named, logged actor with the least access its job needs. It reads, answers and drafts. It changes nothing.
2
Scoped, approved writes
When you are ready, specific write actions are enabled one at a time - each one defined, agreed and ring-fenced to its agent’s charter.
3
Everything logged
Every action is recorded with the reason it was taken and who approved it. You can always see what happened and why.
Posts, account blocks, payments and configuration changes always need a person’s sign-off. That gate is part of the product, and it does not switch off.
What it will and won’t do.
Handley will
- Read your live Business Central data and answer with the entries behind the answer.
- Draft the work: reminders, account blocks, reconciliations, payment runs, returns - staged for your approval.
- Stop an over-limit quote at the gate and route it to your approver.
- Teach your team any BC process, step by step, on your own configuration.
- State its confidence - and below its threshold, propose instead of act.
Handley will not
- Post, pay, block or change configuration without a person’s explicit approval.
- Write or change a bank account number on any record. Human-only, with out-of-band verification.
- Post a plug or a “close enough” balancing entry. Differences are named, aged and owned.
- Post into a closed period, or backdate to change a period’s outcome.
- Guess, or fabricate. If the data cannot support an answer, missing is reported as missing.
On the record, always.
An append-only audit trail. Every action is logged outside Business Central with its inputs, evidence, reason, confidence and approver - and kept for seven years.
Traceable to the ledger. Every posting carries the run that made it, so any entry in your ledger traces back to the decision behind it.
A kill switch, tested. One command halts every write across the pod and leaves reads intact. It is tested monthly, not assumed.
We own the product. Your business data remains yours - and your auditor gets a better trail than a human team leaves.
See Handley on a Business Central scenario.
Book a demo and watch the team work a real scenario - aged AR, an over-limit quote, a bank rec - and see exactly where you stay in the seat.
Book a demo