Diligence · Operating decision guide
How should a portco integrate AI after an add-on acquisition?
Otomat editorial · Revised
Keep the two companies’ identities, data and action permissions separate until each proposed connection has an owner and a tested boundary. Start with one reversible workflow.
Map the work before joining the systems
An add-on acquisition can create two customer records, two approval policies and two versions of the same contract. A shared search tool may make them look interchangeable before management has reconciled them. Choose one handoff, such as a service request moving between the businesses, and draw its source, identity, decision and downstream action. Record the legal entity as well as the system name.
Test the bridge with an awkward case
Use synthetic records for a customer present in both businesses. Give one record a current agreement and the other an expired price. Ask the proposed workflow which terms apply and whether it has authority to act. A useful answer identifies the applicable source or stops for a named owner; it does not silently combine the records. Test a user permitted in only one company as well as a user authorized in both.
| Check | Evidence to bring | Decision or stop condition |
|---|---|---|
| Entity boundary | Source system, owning entity, authorized users and permitted purpose | Do not connect a source while use rights or the owner remain unknown. |
| Conflicting records | Synthetic current/expired terms and conflicting customer identifiers | Require source selection or escalation; never silently merge authority. |
| Action rollback | Before/after records, reversal steps and named executor | Hold live writes until the owner can restore the prior state. |
| Local acceptance | Completed task, exception load and user sign-off | Do not use sponsor approval as a substitute for company acceptance. |
Move in reversible stages
First compare outputs without allowing writes. Then let a reviewer approve a narrowly scoped action. Before increasing access, show how to undo a duplicate ticket, revoke the acquired user’s access and restore the prior routing. Keep a dated exception log so a temporary migration workaround does not become an undocumented permanent policy. Shared ownership of businesses is not itself permission to share every record.
Make integration costs visible
Budget for identity mapping, data correction, permission review, support and staff practice as well as the model. Compare accepted end-to-end tasks with the pre-integration process. If faster retrieval produces more escalations or disputed actions, the integration has moved the work rather than removed it. The sponsor funds the next connection only after the local operating owner accepts the current one.
Questions before the decision
Can both companies use one AI platform?
Possibly. A common platform still needs company-specific identities, authorized data access and action policies. Validate those boundaries on the selected workflow before consolidating.
What should happen before granting write access?
Inspect the read-only comparison, denied-access cases, exception path and restoration exercise. Then give only the permissions needed for the accepted action.
Take the evidence sheet to the meeting
Download the blank CSV, assign an owner to each check and record the evidence. Keep completed sheets in your own approved system.
Download the evidence sheet (CSV)Use the working tools
Blank templates are ungated. Adapt them to the workflow; inputs are not submitted.
Sources and limits
These are Otomat’s proposed operating methods and original decision artifacts. External references inform risk management; they do not certify this method or establish client results. Linked sources were selected for this review; their live revision dates may change.
- NIST AI RMF: governance, measurement and risk management context
- OWASP: excessive agency and action permissions
For anonymous documentation and proposal patterns, see delivery evidence and its boundaries.
Related decisions
Bring a workflow to the discussion
Share the business goal and constraints through the mandate process. Do not send sensitive production data in the initial brief.
Book a Return Review