Separate knowledge, current records, and transactions

Policy documents describe who may approve a purchasing exception and why. Live inventory entities show available stock in a company and warehouse at a given moment. Transaction APIs enforce updates and post accounting events. Those are three distinct contracts. A single conversational interface may coordinate them, but it should not turn a retrieved paragraph into permission to adjust quantity or bypass financial approval.

Begin by listing which questions are explanatory, which require live records, and which ask for a state change. Define the responsible application and owner of each. For inventory inquiries, specify company, legal entity, product, location, units of measure, and point-in-time freshness. An answer without those dimensions can be confidently wrong even when it retrieves real data.

Use authorized operational data through supported surfaces

Microsoft documents finance-and-operations virtual entities exposed through Dataverse, including examples for on-hand inventory and customer credit-risk queries. A Copilot Studio agent can use those entities as knowledge where supported in the target environment. This is a way to access current operational information; it is not license to reveal every account or inventory row to every employee.

Permission trimming must apply before facts are shown to the model or user. Map roles in the source application, DataVerse access, service identities, and agent channel authentication. Test a user with access to only one legal entity. If the agent answers with restricted records from another entity, the architecture has failed even if the numeric answer is accurate.

Finance and supply chain operations distinguish current transaction state from reference knowledge. An agent may explain purchase-order policy using governed documents, but it should verify a vendor hold, credit status, available-to-promise quantity, or inventory balance through an authorized live application query before recommending a write. If an agent chat connects to additional knowledge sources, specify whether those sources merely inform the response or are authoritative for a business rule. That prevents a stale help article from overruling a live ledger or procurement workflow.

Make actions explicit and reversible where possible

For a proposed supplier hold release, define a typed business request containing supplier ID, company, order ID, request reason, expected state, and a unique operation identifier. Perform authorization and deterministic policy checks in the business service. The agent may provide evidence and propose next steps, but the final operation should honor established approval routes.

Where reversibility is limited, require additional review. Financial posting may not be safely undone by a second agent call. Build an exception workflow with a human approval receipt, audit trail, and clear status checks. Retries must be idempotent or reconciled so that a connector timeout cannot trigger duplicate activity.

Design how Copilot interacts with application help and workflows

Dynamics 365 finance-and-operations experiences can include embedded AI, sidecar assistance, and guidance. The architecture should choose whether the task belongs in application help, a natural-language data question, or an operational workflow. For example, “Where do I configure invoice matching?” is help; “Which invoices fail matching today?” needs live data; “Approve these invoices” is a governed write.

Avoid mixing public product documentation with confidential enterprise policy without source labels. Internal help has owner, effective date, and approval status. External product documentation explains product behavior but should not override internal delegation of authority. Review the business-process integration guide for cross-system contracts.

Create an operational acceptance scenario

Use an order whose available quantity changes between initial retrieval and final approval. Test whether the system detects stale state and refuses to apply a decision based on an expired snapshot. Add a second case where an employee can view a stock total but lacks authority to release a reservation. The agent must explain the limit instead of attempting an alternate privileged route.

The test record should include source versions, actor identity, legal entity, requested fields, tool result, approval decision, and downstream status. Validate the business record after the action, then simulate loss of the connector response. A well-designed system can determine whether the write succeeded without blindly repeating it.

One useful exercise begins with a purchase-order exception: a supplier confirmation conflicts with the recorded delivery date. The agent should identify the discrepancy and cite the live records, but changing a committed delivery promise requires the correct business transaction and ownership. The test should include a supplier that is on hold, an approval that expires, and a user without write permission. Success means the agent routes the exception into an auditable process, not that it produces a plausible explanatory answer.

Operate the solution within finance change controls

Release sequencing matters because data models, finance policies, and connected agents can change independently. Maintain regression tests for legal-entity boundaries, currencies, units, approval routing, and exception handling. Assign a finance-process owner to sign off on the business consequences, and a platform owner to maintain integrations and telemetry.

The correct architecture reduces search and decision time while keeping the source application in control. That is the AB-100 design skill: selecting the right AI experience and proving that enterprise finance and supply-chain constraints still govern every answer and action.