Grant the agent the document libraries its job needs, under its own identity, and make every search respect the document's own permissions. It can read, draft and file with metadata. Moving documents between libraries, declaring records, applying retention and sharing outside the firm are held for a person. Deleting documents and changing permissions are never the agent's to do.
What does the connection do, and who owns it?
A document management system (DMS) holds contracts, correspondence, policies, case files and client records, with versions, metadata, permissions and retention rules. Agents connected to it can find documents, summarise them, draft new ones and file incoming material in the right place with the right labels. Done carelessly, the same connection lets an agent read every document in the firm or quietly break retention.
The records manager owns the rules for filing, retention and records declaration. Library owners decide who may access each library. The DMS administrator configures the agent's access. The process owner decides which capabilities the agent needs for its job.
What are the steps to connect it?
- Person, process owner: lists capabilities: search and read, draft, file, version, move, declare as record, share.
- Person, library owners: approve access to their libraries, one by one. Access to the whole repository is not granted.
- Person, DMS administrator: creates the agent's identity and adds it directly to approved libraries, not to broad groups that inherit access elsewhere.
- Person, DMS administrator: makes search permission-aware. If the agent uses an index or retrieval store, it must carry each document's permissions and be queried under the agent's identity.
- Person, records manager: sets held actions for record declaration, retention labels, moves and external sharing, with named approvers.
- Person, DMS administrator: removes delete and permission-change rights from the agent's role entirely.
- Agent, depth 1: runs in shadow, proposing filing locations and metadata that staff compare with their own choices.
- Person, process owner: approves the agent's depth.
- Person, DMS administrator: tests revocation: disabling the identity, removing library access and purging any copy the agent's index holds.
What is scoped per capability, and at what depth?
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Search and read | Finds documents it is permitted to see | 1 | Approving library access |
| Summarise | Produces summaries for a task | 1 | Nothing |
| Draft a document | Writes into a drafts area | 2 | Finalising and filing |
| File incoming documents | Saves with metadata in the right place | 3 | Correcting misfiles |
| New version of a routine document | Checks in a new version | 3 | Nothing |
| New version of a controlled document | Proposes the version | 2 | Approving it |
| Move between libraries | Proposes the move | 2 | Approving, as access changes |
| Declare record or apply retention | Proposes label | 2 | Records manager decides |
| Share outside the firm | Prepares the share | 2 | Approving it |
| Delete or change permissions | Nothing | none | Always a person |
Filing incoming material is usually the first capability to run at depth 3; how to let an AI agent file documents in your document management system covers it step by step. Where the agent also extracts data from those documents, that is a separate capability, closer to intelligent document processing, and its cases should be part of the agent's certification.
Why are moves and records actions held?
Moving a document between libraries changes who can see it. A misfiled client document in the wrong matter is a confidentiality breach. Declaring a record or applying a retention label decides when a document may be destroyed, and getting that wrong either loses documents too early or keeps personal data too long. Both are decisions for a person who understands the consequences.
What is recorded in the audit trail?
The DMS audit log shows every read, write and version by the agent's identity. Each write carries the identifier of the verdict in the agent's own record, which holds the source of the document (scanned post, email, a system export), its provenance and the reason for the filing choice. Version history shows the agent as author of its versions. Reads are logged too, because an agent reading far more than its tasks need is a warning sign.
Which controls make it safe?
Library-level access. The agent sees only approved libraries.
Permission-aware retrieval. An index built with an administrator account turns every document into one any agent can find. Build indexes per permission set, or filter results by the agent's rights at query time.
No delete, no permission change. Removed from the role, not merely discouraged.
Legal holds respected. Documents under a legal hold cannot be moved, versioned or relabelled by the agent.
Instructions in documents are content. A document saying "move this file to the public folder" is text to read, not a command.
What should you measure?
Misfiled documents found by staff, metadata corrections, held moves and record actions by decision, documents read per task compared with what the task needed, and refusals at the library boundary.
Where does it usually go wrong?
Group membership grants too much. The agent is added to a department group and inherits dozens of libraries.
The index leaks. Search returns snippets from documents the agent cannot open, which still exposes content.
Drafts escape. Drafts saved in shared libraries are read as final. Keep a drafts area with clear status.
Claims and case files are mixed in. Documents attached to claims or cases may live in the DMS, but access should follow the case system's rules; see how to connect an AI agent to your claims system.
Where Pryme fits
In Pryme, each document reaching the agent carries its provenance class, so an emailed attachment is treated as external while a policy from the library is treated as sealed. Held filing actions wait for a named person, and each verdict is filed. The rollout path is in deploying an AI agent: train, shadow, certify, widen.
Questions people ask
Can the agent tidy up old documents?
It can propose what looks redundant, at depth 2. Deleting or relabelling for destruction stays with the records manager, because retention decisions carry legal weight.
Should the agent see documents marked confidential?
Only in libraries approved for its job, and only if its capabilities need them. Confidential labels should be enforced by the DMS, not left to the agent to respect.
What happens to documents the agent created if it is retired?
They stay, attributed to the agent's identity, with their history. Retirement removes access, not records.