Insight · Integration & architecture
How to integrate AI with ERP, CRM and legacy systems
An AI agent is worth what it can look up and do. This is the architecture that connects it to systems of record without replacing or exposing them.
Short answer
AI is integrated with ERP, CRM and legacy systems through an API layer that exposes scoped capabilities —checking an order, logging a case, creating a request—. The agent uses those capabilities as tools, with least-privilege permissions and a record of every call, and never accesses databases directly. There is no need to replace the core system: encapsulating it is enough.
The principle: AI consumes capabilities, not tables
The fastest way to connect a language model to a system is to give it access to the database. It is also the riskiest: the model can read data it should not, misread the structure or run operations that bypass the system's business rules.
The alternative is to expose business capabilities as named operations with validated parameters and a defined response. "Check order status" is a capability; "SELECT on the orders table" is not. The system's rules still apply because the operation goes through it.
A five-layer reference architecture
- Channels: web, WhatsApp, email or portals where the user talks.
- Agents and workflows: interpret the request, follow the process and decide which tool to use.
- Integration layer: APIs and events with versioned contracts, authentication and usage limits.
- Systems of record: ERP, core, CRM and legacy applications, which keep the data and the rules.
- Data and knowledge: sources of truth and document bases for RAG.
Security, observability and governance cut across all five layers. The agent only knows the integration layer: an ERP can be replaced without touching the agent, as long as the API contract holds.
What to do when the system has no APIs
This is the usual case with legacy systems. There are four options, from most to least preferred:
| Option | When to use it | Consideration |
|---|---|---|
| Vendor API or integration module | The product offers it even if it is not enabled | Usually the most stable and supported route |
| Façade service over existing logic | There is access to the system's code or procedures | Reuses current business rules |
| Reading from a data replica | Only queries are needed, not writes | Data may lag by minutes |
| UI automation (RPA) | There is no other way | Fragile to screen changes; use as a temporary bridge |
Writing directly to a legacy system's database is rarely acceptable: it skips validations and can leave data in a state the system itself does not expect.
Designing tools for the agent
Each capability the agent can use is defined as a tool. A good design meets these conditions:
- One tool, one action: specific names and minimal parameters.
- Server-side validation: the API checks every parameter; it does not trust what the model sends.
- End-user identity: the tool acts with the permissions of the person in the conversation, not with a generic all-access account.
- Reads separated from writes: querying is low risk; modifying calls for additional controls.
- Idempotency: repeating a call does not duplicate the operation.
Control: human approval and traceability
Operations are classified by impact. Queries run directly. Reversible, low-impact actions —logging a case, updating a contact detail— can run with user confirmation. Actions with financial or legal impact are prepared by the agent and wait for approval by an authorized person.
Every tool call is logged with who originated it, which parameters were sent and what the system returned. That log makes it possible to audit, diagnose errors and measure real usage.
Recommended implementation sequence
- Choose one process and list the capabilities it needs (usually three to six).
- Expose read-only capabilities first.
- Deploy the agent with those queries and measure.
- Add low-impact write actions, with confirmation.
- Bring in sensitive actions with human approval.
Each step delivers value on its own and leaves an API that other channels can reuse, not only AI.