Jmix gives its warehouse AI agent write access: security and auditing

The developers behind the Jmix platform have published the second part of their article on a warehouse AI agent built on Spring AI, Habr reports. This time, the agent can modify data, not just read it, and the authors cover security, auditing, and working with the business model.

What was in the first part

In the first part, the team built a read-only agent inside a Jmix application. A user asks a question in natural language, and Spring AI's ChatClient runs the agent loop, calling @Tool methods until it has gathered enough data to answer.

• The read-only agent from the first part answers user questions in natural language
• Each tool reads data through DataManager with an explicit fetch plan
• This approach stays almost entirely within Jmix's security system and returns only the fields the model needs
• The agent's UI is a regular Jmix view, with no REST layer
• The authors specifically note that a model without reliable native tool calling breaks the entire agent workflow

What questions came up with write access?

Once the agent could change data rather than just read it, questions surfaced that neither the Spring AI documentation nor most agent tutorials usually address. Which user does a model-invoked tool actually run as? How do you handle transactions when the model calls several tools in a row? How do you audit actions initiated by the AI rather than directly by a human? And how do you get the agent to work with the application's domain model without manually listing every entity in the system prompt?

According to the authors, these aren't cosmetic tweaks. They are exactly the decisions that separate a demo prototype from an application you can show a customer — a system ready for real-world use in a warehouse.

What this means

The move from a read-only agent to a write agent shows that the hardest part of building AI agents for business applications isn't getting the model to call tools. It's identity, transactional integrity, and auditing — and without them, letting a model modify data is simply unsafe.

FAQ

What could the AI agent from the first part do?

It was read-only: it answered user questions about the warehouse in natural language, calling @Tool methods through Spring AI's ChatClient while staying within Jmix's security system.

What questions does the second part cover?

Which user a tool runs as, how to handle transactions across a chain of calls, how to audit actions initiated by the model, and how to work with the domain model without manually listing entities in the prompt.