Enterprise AI Lab

AI lab by Beat Hutter

The journey to the agentic enterprise

An AI lab that runs every day. It is where an agent framework for enterprise use is being built, with governance, human-in-the-loop and tightly scoped permissions. Testing happens on a simulated company with its own ERP and mailbox.

Project on GitHub Beat Hutter on LinkedIn
Illustration: a friendly AI robot in a lab coat holds an Erlenmeyer flask with green liquid. Next to it are test tubes and a laptop showing an agent workflow, behind it a whiteboard listing Agents, Governance, ERP and Human-in-the-Loop.
Agent harnessHermes, open source
Tool access via MCPapproved tools only
Human-in-the-loopapproval by button
ERP at the coreOdoo 18 with full accounting

The AI lab

The lab examines what AI agents can do in a company today and under which conditions they can be allowed to work.

A whole company as test bed

The simulated Muster AG is a Swiss industrial business. It has two years of business data: customers, suppliers, orders, accounting and closings.

Proven and new

The lab tests proven methods and new approaches that are not yet established in practice. Every test has expected results and built-in traps.

Continuously evolving

The lab is used and extended every day. New use cases are added continuously, and quality and cost are measured for each.

Note: Muster AG is a fictional company. All companies, people and figures in the lab are made up.

Architecture of the agent framework

The agent may read, but only with read permissions. Anything that changes data goes through validated tools. Consequential steps are approved by a human.

Channelshow work comes in
ChatEmailSchedulesWeb botTicketsPhone
▼
Agentharness and knowledge
Hermes agent harnessAgent “Manni”Versioned skillsSemantic layerSwappable language models
▼
Control layergovernance
Read-only accessMCP tool serverValidation in the toolWrites as drafts onlyPrompt injection defence
▼
Systemswhere the data lives
Odoo 18 ERPMailboxCRMHelpdeskMicrosoft 365
▼
Infrastructureself-operated
Business laptopUbuntu on WSL2DockerIsolated service userTailscale, no open portsLangfuse

Human-in-the-loop

Approval by buttonSkills released by a humanSensitive items escalated

Traceability

Log of every sessionCost per runTest sets with expected resultsObservabilityFinOpsAutomated evals
in operationplannedgovernance

What the agent handles today

The agent works on request in chat and autonomously on schedules. It has read access to the entire ERP.

Payables

Supplier invoices

Read documents, match suppliers, propose account assignments, flag anomalies.

Sales

Customer quotes

A request becomes a quote in the ERP, with prices and terms from master data.

Controlling

Monthly reports and KPIs

Key figures with a fixed calculation, with commentary for management.

Analytics

Analysis and research across the ERP

Questions in natural language, answers from sales, purchasing and accounting data.

Inbox

Email management

Classify every email, handle requests, detect and escalate anything suspicious.

Security

Resistance to manipulation

The agent recognises deception attempts in emails and documents and reports them.

Governance and principles

An agent needs fixed rules before it may work in a company. These apply in the lab:

  1. Least privilege

    The agent reads the ERP and the mailbox with access that can only read. Permissions live in the target system, not in the prompt.

  2. Tool-based access via MCP

    Anything that changes data runs through a dedicated tool server with narrow, validated tools. There is no other way to write.

  3. Human-in-the-loop

    Consequential actions need approval by button, which the agent cannot trigger itself. A “yes” in the chat does not count.

  4. Content is not a command

    Whatever an email or document says is material. The agent does not follow instructions inside it, it reports them.

  5. Semantic layer

    Fixed definitions and calculations, so the agent answers the same question the same way every time.

  6. Versioned skills with release

    Domain knowledge lives in skills under version control. Changes go live only after review, including those the agent proposes itself.

  7. Vendor-agnostic

    ERP, mailbox and language model are replaceable building blocks. The business logic does not depend on any single product.

Roadmap

What runs today, what comes next and what is being researched.

In operation

today
  • Agent with skills on its own harness
  • MCP tool server with approval
  • Finance and sales in the ERP
  • Email management on schedule

Next

ongoing build-out
  • Observability and FinOps with Langfuse: tracing, quality, cost and budgets
  • Approval workflows for postings
  • CRM and lead management
  • Project bot on this website

Then

expansion
  • Customer service: tickets with AI triage
  • Dunning and payment matching
  • Purchasing and material planning
  • Microsoft 365 and comparison with Copilot
  • Voice agent for incoming calls

Research

open questions
  • Multi-agent organisation: agents run functions
  • Synthetic business world: agents act as customers and suppliers
  • Learning loop: the agent proposes improvements, a human releases them

Technology

Operated on own hardware, with no open ports. Only the language models run at the respective provider.

Agent harness
Hermes Agent, open source, running as a service under an isolated user
Tools
Model Context Protocol (MCP), dedicated tool server in Docker
Language models
swappable per task, including Anthropic Claude and DeepSeek
Interaction
chat via Telegram, schedules for recurring work
ERP
Odoo 18 Community with Swiss localisation and OCA modules for financial reporting
Mailbox
Gmail via OAuth, read-only
Platform
business laptop, Windows 11 Pro, Ubuntu 24.04 on WSL2, Docker
Observability
Langfuse for tracing, quality and cost (planned)
Network and development
Tailscale for remote access, Git and GitHub, Claude Code as development agent

Google application “Muster AG (Labor)”

This page is also the home page of the Google application “Muster AG (Labor)”. It gives the agent read-only access to the project's lab mailbox. The agent classifies incoming emails and prepares drafts inside the lab. It cannot send, delete or modify emails and does not access any other mailbox. Details are in the privacy policy.