AI Warehouse Agent in Jamix Gained Write Access: Security and Audit

The developers of the Jamix platform published the second part of an article about an AI agent for a warehouse based on Spring AI: this time the agent was given the right not only to read but also to modify data, and they addressed security, audit, and business model questions, reports Habr.

What Was in the First Part

In the first part, the team assembled a read-only agent inside the Jamix application. A user asks a question in natural language, and ChatClient from Spring AI runs the agent loop — calling @Tool methods until it gathers enough data to answer.

• The read-only agent from the first part answers user questions in natural language
• Each tool reads data through DataManager with an explicit fetch plan
• This approach largely remains within the Jamix security system and returns only the necessary fields of the model
• The agent UI is a regular Jamix view, without a REST layer
• The authors separately note: a model without reliable native tool calling breaks the entire agent architecture

What Questions Arose When Moving to Write Operations

When the agent was given the right to change data rather than just read it, questions surfaced that documentation for Spring AI and most agent tutorials don't raise. Under which user does the tool invoked by the model actually execute? How to handle transactions if the model calls multiple tools in sequence? How to audit actions initiated by AI rather than directly by humans? And how to make the agent work with the application's domain model without manually listing all entities in the system prompt?

According to the authors, these are not cosmetic improvements but the very solutions that separate a demo prototype from an application you can show a client — that is, from a system ready for real-world warehouse operation.

What This Means

The transition from read-only to write agent shows that the most difficult part of building AI agents for business applications is not the model's ability to invoke tools, but questions of identity, transactional integrity, and audit, without which giving a model permission to modify data is simply unsafe.

Frequently Asked Questions

What

Could the AI Agent from the First Part of the Article Do?

It was read-only: it answered user questions about the warehouse in natural language, calling @Tool methods through ChatClient from Spring AI and remaining within the Jamix security framework.

What Questions Does the Second Part of the Article Address?

Under which user does the tool execute, how to handle transactions when multiple tools are called in sequence, how to audit actions initiated by the model, and how to work with the domain model without manually listing entities in the prompt.