The CRM Where the Agent Takes the Notes

An open-source CRM built on one inversion: the agent is the primary user and the human is the exception handler. Its best idea has nothing to do with AI.

Conventional CRMs are a database with a form in front, and their known failure is that the two activities that cost the most time, finding out what is true about a person and recording it, are left to a human who is worse at both and has better things to do. The AI variants mostly bolt a chat box onto the same form. One open-source project, Comp AI's CRM, MIT-licensed and past 7,000 stars, starts from the opposite end. Its README states the thesis in one line: the agent is not a feature of the CRM, the CRM is where the agent keeps its notes.

The agent runs on its own schedule against its own work queue. It decides which contact to research next, spends a bounded research budget, books its own follow-ups, and keeps going after the browser closes. When it wants a second look at a person in two weeks it must supply a reason, and the reason is shown to the human. The stated rationale: an agent that cannot say why it will return in fourteen days does not have a reason, it has a default.

The Ban on Confidence Scores

The design choice worth stealing is a prohibition. No tool in the system accepts a confidence score, on the reasoning that a model asked to grade its own certainty will comply, and will err in the direction that makes it look useful. Instead, tools report what they observed, tagged with named evidence types from a closed vocabulary: a signature block in an email thread, a verified account identity, a company registry entry. A ledger prices each evidence type. Strong evidence writes to the record. Weak evidence becomes a suggestion a human settles.

The justification is blunt: a confidently wrong fact about a customer is worse than a blank field, because nobody can tell it is wrong. A blank field is visible. A wrong fact is trusted.

A confidence float is unfalsifiable by construction. A named evidence type is auditable. The ledger converts an epistemic question into a schema question, which is the only form that can be checked after the fact.

Security by Subtraction

Two more decisions share the same character. The agent's sandbox gets shell tools and a workspace, and is denied two things: outbound network access, and the database credentials. The README's phrasing deserves the quotation marks: a shell with credentials and egress is exfiltration-shaped, even in an internal tool, and a shell with neither is a text processor. And the system is deliberately single-tenant, because a tenant ID column that always holds the same value is an index and a permissions check that buy nothing while reading like real security at review time.

Each of these is a subtraction defended by the specific failure it prevents, not a principle it honours. That is the signature of software written by people who have been burned. For anyone specifying an AI system this quarter, the evidence ledger is the transferable requirement: make the machine say what it saw, in a vocabulary you fixed in advance, and price it. Never ask it how sure it feels.

Part of the Product Pipeline series from KG Consultancy.