Agentic CRM needs a control plane, not just a clever prompt

The action boundary changes the product

A summarizer can be treated like a feature. An agent that sends a message, changes a deal stage, issues a refund, or edits a customer record has crossed into operations. At that point, model quality is only one part of the safety case.

The CRM needs a control plane that decides who or what may act, on which workspace, through which tool, within what budget, and under which approval policy. The data plane should never infer those permissions from a persuasive model response.

A minimum trustworthy loop

The useful unit of agent work is not a chat turn. It is a governed transaction: observe, propose, evaluate policy, request approval when needed, execute idempotently, and record the result.

• Bind every agent to a first-class identity and workspace.
• Grant named tools, not ambient access to the whole platform.
• Separate read, propose, approve, and execute permissions.
• Record inputs, policy decisions, tool calls, outputs, and failures.
• Provide an emergency stop that prevents new work immediately.

Risk management is continuous

NIST organizes AI risk work around govern, map, measure, and manage. That is a useful reminder for CRM builders: evaluation does not end when the agent ships. Permissions drift, tools change, customer data evolves, and an apparently harmless workflow can become consequential when connected to another system.

A serious Agentic CRM therefore treats policies and receipts as product surfaces. Humans should be able to understand why an action was proposed and stop the system without negotiating with the agent that is being stopped.