Why read-only access to 1C is all an AI agent needs — and why it is the key condition of any implementation

The first question an owner asks in any discussion of an AI agent is always the same: “What if it breaks something in 1C?” It is the right question. 1C — the ERP/accounting system standard in Russia — is where the money, the taxes and the reporting live; a mistake there costs more than all the benefit automation can bring.

That is why my implementations run on one hard rule: the agent gets read-only access to 1C. Not “writes carefully”, not “writes with confirmation” — it doesn’t write at all. Technically, that is a separate user account with view-only rights: even a bug in the agent’s logic physically cannot alter a single ledger entry.

What that leaves the agent to do

Almost everything it is paid for. Look at what an agent’s work consists of at a wholesale company:

• finding overdue payments — that is reading the settlements ledger;
• noticing that a customer has dropped out of their usual ordering rhythm — reading the sales history;
• spotting an order that has been paid but not shipped — reading statuses;
• calculating how many weeks the current stock will last at the current rate of consumption — reading the warehouse.

Not one of these tasks requires writing to the accounting system. Writing is needed elsewhere — in the CRM: assigning a task to a sales rep, setting a reminder, leaving a comment on a deal. There the agent does write, but not indiscriminately either: the list of permitted operations is fixed during implementation. In the AI Sales Employee case study there are nine such operations — and not one of them deletes anything.

Why this is the right architecture, not a compromise

There is a temptation to give the agent more rights “for convenience”: let it create documents itself, post adjustments itself. I don’t go there, and here is why.

The boundary “reads the books — writes to the CRM” coincides with the boundary of responsibility. The books are the accountant’s territory, and decisions there should be posted by a human. The CRM is the sales team’s working tool, and a task like “call the debtor” carries no risk to the reporting whatsoever: the worst that can happen is one reminder too many.

What’s more, this boundary makes the implementation verifiable. My pilot phase always starts in “read-only and reports” mode: for two weeks the agent writes up what it would have done — and people check it. It earns the right to assign tasks only after the reports stop raising questions.

What to take away

If you are offered an AI implementation where the agent writes to the accounting system from day one, ask why. Nine times out of ten, the same benefit is achieved by reading the books and writing to the CRM, and the tenth case deserves a separate conversation with your accountant, not a tick in the access-rights settings.

See how it works in practice in the AI Sales Employee case study: the very first run on real data surfaced 18 debtors — without a single write operation to 1C.