This page describes the working rules ERP Access applies on client systems today. It separates practice from aspiration: if something is a goal rather than a habit, it is not on this page.
The governing rule
AI reads and talks. Deterministic code verifies and calculates. Humans handle exceptions.
- Claude reads and drafts. Claude reads the documents a team already works from (leases, LOIs, filings, invoices, email, tickets) and drafts the next step in plain language.
- Code verifies and calculates. Every amount, date and business rule is computed or checked by deterministic code, not by the model. If the source does not support a value, the system refuses instead of guessing.
- People approve the exceptions. A named reviewer on the client's team approves anything before it reaches the system of record. The AI never has the last word.
The rule exists because language models are good at reading and drafting and unreliable at arithmetic of record and at knowing what they don't know. Each part of a system is given to the component that does it reliably.
How an engagement runs
Phase 1: Before building, find out what is really there
- Read-only first. Work starts with read-only access, and every action in the client's account is logged. In NetSuite that means a dedicated role for Claude with only the permissions the work needs, never an administrator role.
- Evidence before verdicts. Every keep, simplify or drop call carries its evidence. If NetSuite cannot prove a saved search is unused, the report says "no recorded UI execution," not "unused."
- Mine the text, not only the tables. Tickets, memo fields, approval notes and email show how a process actually runs; the structured data shows how it is supposed to. The gap is where the work is.
- Sandbox before production. New connections and workflows run in sandbox first, then in production for a small group, expanding role by role.
- Respect shared limits. NetSuite shares one web-services concurrency limit across all integrations, so heavy AI queries and extracts are scheduled so they don't starve existing feeds.
Phase 2: While building, make the system refuse rather than guess
- Refuse instead of guess. If a document doesn't support a value, the system refuses and routes it to a person.
- Code does the math of record. Rents, dates, escalations, totals and accruals are computed and checked by code against bounded rules.
- Tests and evaluation gates. AI steps ship with a regression test suite and an evaluation set. On the George Urban lease grader, a release that drifts on accuracy is held until the cause is understood.
- Security review on every change. Pull requests get an automated security review; every change ships with a backup and a before-and-after check.
- One source of truth. Working files and side spreadsheets are folded into one database and one application, so there is a single record everyone trusts.
Phase 3: Before go-live, someone other than the builder checks it
- Independent review. A separate review pass, by a reviewer that did not produce the work (a person or a separate critic agent), checks results and claims before a client sees them. The firm's critic loop is bounded: three attempts, then escalation to a person.
- Parallel runs on the client's own history. When a script, report or calculation is replaced, the new version runs alongside the old one on the client's data and goes live only when there are no unexplained differences.
- A client-side release reviewer. On George Urban's platform, a George Urban operator reviews each release before it ships.
- Re-tested at every NetSuite release. Roles and connector behavior are re-tested in sandbox before each NetSuite release reaches production.
Phase 4: After launch, keep a person in charge
- A named approver. A named person on the client's team approves before anything reaches the system of record.
- Exceptions become rules. Each exception a reviewer catches is written up as a proposed rule, so code stops the same mistake next time.
- Drafted, not sent. Messages to customers, vendors or tenants are drafted for a person to send.
Security and data handling
- Least privilege. AI connectors get dedicated roles scoped to the task.
- Row-level access. Client applications enforce access in the database, so an operator sees only the records they are entitled to.
- Health data. Protected health information stays in the systems built for it and is not routed through the NetSuite AI connector, which Oracle states has not been assessed for HIPAA.
- Interns and client data. Engineers in training work only on internal projects until they have completed training and met each client's confidentiality requirements.
- Certifications not yet held. ERP Access does not hold a SOC 2 report today. It expects to need SOC 2 for the Voyont filing service and describes its controls plainly in the meantime.
Quality evidence that can be inspected
- SAP Transaction Forensics: 18 analysis and data MCP tools plus 9 governance tools, with a public synthetic demo.
- PromptSpeak MCP server: pre-execution governance for AI agents; 56 tools; 829 passing tests per its README.
- Ralph Dispatch: budget-fenced, critic-gated agent orchestration; models get no tools, shell, web access or credentials; work is published only after a schema-valid critic verdict.
- SaaS Rebuild: schemas that reject any verdict without cited evidence.
What ERP Access does not do
- Give an AI an administrator role in an ERP.
- Let a model calculate a number that goes into a ledger, a lease or a filing.
- Send anything on a client's behalf without a person pressing send.
- Put protected health information through the NetSuite AI connector.
- Describe designed features as built.
- Inflate headcount, partner status or project counts. See the claims register.
- Call work done before the evidence says it is.