Keep your CRM, add the decision record

GembaOS is a zero-trust governance runtime for enterprise AI agents: policy-decided access, single-use clearance tokens bound to exact parameters, and accountable human approvals, running on-premises or in a private VPC. This scenario is the existing-CRM case: the CRM stays the system of record for accounts and cases, and GembaOS holds the decision record for what happens beyond it.

How do we keep our CRM and its agent, and still own the decision?

GembaOS leaves the CRM as the system of record and puts itself only where an action leaves the CRM: it reads the case under field-level rules through the capability gateway, composes the cross-system action, routes it by policy, and after the signature executes it once under a clearance token. The decision goes back to the case timeline as a comment, so the CRM shows what happened and GembaOS shows who decided and why.

	Before	With GembaOS
Routine closure	The CRM agent closes the case	Still passes, on the agent stamps, and is recorded
Escalated or legal-hold case	Closed by whoever has the button	Stops at the CS supervisor, who signs with a passkey outside the vendor
The action beyond the CRM	A refund or credit note with no accountable owner	Executed once, under a clearance bound to this case and this reason
The record	Lives with the vendor, in the vendor’s format	The signature chain and the replayable decision live with you; the CRM gets a comment

What happens, step by step?

Step	Who	What is recorded
1. Case event	The CRM or its agent calls GembaOS	The event and its external reference
2. Pre-read	The host reads the case, trimmed to the fields the specialist may see	The facts on the request
3. Route	The policy: routine passes, escalated or legal hold needs a person	The route and the rule chain
4. Sign	The CS supervisor with a passkey	The signature chain
5. Execute	The host re-reads the case, compares, then closes it once under the clearance	The precondition check and the execution
6. Mirror	The decision is written back to the case as a comment	The external reference of the comment

Where is the control point?

The control point is the route decision on the pre-read facts, and the human signature for the cases the policy reserves. The CRM agent, the vendor’s own or yours, can call the same gateway the same way; what it cannot do is close an escalated case or move money on its own authority. The same pack serves several CRM wire shapes; the field names and the id formats are the only parts that change between vendors.

What does it look like in the console?

GembaOS approval desk showing an escalated CRM case closure awaiting the CS supervisor

GembaOS work item timeline showing the case re-read, closed once and mirrored back to the CRM

GembaOS audit view replaying the decision records for the case closure

What do we need to start?

API access to the CRM for reading cases and writing comments, with the credential held at the gateway.
The field-level rule: which case fields a support specialist may see.
The escalation and legal-hold rule as it stands: which cases need a person, and who.
If the CRM’s own agent will call GembaOS, its MCP or tool-call interface.