DIRECT ANSWER
Map where data enters, where it is written and who knows when it fails before connecting systems.
Confirm five things: the system of record, field mapping, read and write permissions, mandatory human approval, and how failures retry, alert and fall back to people.
Without these decisions, even an accurate model can write to the wrong place, create duplicates or fail silently.
Separate customer touchpoints, business systems and control.
Customer touchpoints
Forms, WhatsApp, email, uploads, call records and other triggers collect original inputs.
Business systems
CRM, sheets, ERP, accounting, inventory, databases and internal platforms hold and update official records.
Control and monitoring
Permissions, validation, deduplication, logs, alerts, approval, retries and recovery prevent silent failure.
Document nine fields for every system.
System and owner
Record platform, department, daily users, technical administrator and decision owner.
System of record
When a customer, order or invoice appears in several places, define which version is official.
Interface and permissions
Confirm APIs, webhooks, exports, email or other interfaces and the allowed read, write, delete and bulk actions.
Data and risk
Record field formats, update frequency, personal data, retention, sensitivity, common gaps and failure impact.
Official APIs and webhooks are normally most stable. Browser automation is a last resort.
API
Good for active reads and writes with permissions, status codes, versions and limits. Monitor tokens, rate limits and vendor changes.
Webhook
Good for immediate events such as form submissions or payments. Verify origin, handle retries and prevent duplicate execution.
CSV, email or batch import
Useful for legacy or scheduled batches, but versions, field changes, duplicates and incomplete batches need controls.
Browser automation
Use only when no stable interface exists. Screen, login, verification and button changes can break it, increasing maintenance and risk.
Inconsistent field names need one canonical data definition.
Company Name, Customer, Account and client name may refer to the same thing or different levels. Define name, format, requirement, allowed values, validation, system of record and error handling for every field.
Test missing fields, wrong formats, duplicates, long values, new supplier formats, record conflicts and denied writes.
Money, deletion, customer commitments and low-confidence results need named approval.
High-risk actions
Formal quotations, payments, refunds, deletion, material inventory changes and sensitive messages should not complete from a black-box result.
Low confidence and new exceptions
New formats, conflicting data and results below the approved threshold should preserve source, reason and reviewer.
Sampled review
Even when high-confidence cases run automatically, sample them to detect quality changes caused by data or platform updates.
Before retrying, make sure the same action cannot happen twice.
Every job needs a unique identifier, clear state and execution record. Temporary network errors can retry a limited number of times. Repeated failure, data issues or denied access should stop, alert and enter a manual queue. Reconcile after recovery to find missing or duplicate work.
Use 30 days for inventory, prototype, testing, pilot and handover.
Days 1-5: inventory and baseline
Confirm workflow, systems, data, owner, volume, current failures and success criteria.
Days 6-12: mapping and prototype
Use safe samples to confirm fields, interfaces, normal path, approval and minimum viable scope.
Days 13-20: exception and acceptance tests
Test normal, failure, edge, retry, duplicate, alert, fallback and expected-result cases.
Days 21-30: controlled pilot and handover
Limit traffic, monitor outcomes, fix issues, create a runbook and obtain owner approval for launch.
Confirm fifteen items before production integration.
Workflow and data
Owner, success criteria, system of record, field definitions, test samples and personal-data retention are confirmed.
Permissions and security
Production accounts, least privilege, credential storage, webhook verification and access removal are tested.
Exceptions and recovery
Deduplication, retry limits, approval, alert recipients, fallback, rollback and reconciliation ownership are assigned.
Frequently asked questions
Can a legacy system without an API be integrated?
Sometimes exports, email, databases, RPA or other methods work, but reliability, permissions and maintenance are normally harder. Compare a supported interface or platform change first.
Does integration require replacing the current CRM?
Not necessarily. A mature approach normally keeps the existing system of record and adds only the necessary connections, validation, sync and exception handling.
How do we prevent duplicate leads or orders?
Give every event a unique identifier, check existing records before writing, reuse the identifier on retries and reconcile incomplete and duplicate states.
Can personal data be sent directly to AI?
Not without assessment. Confirm purpose, minimum necessary data, access, provider terms, retention, transfer, deletion and human responsibility under Hong Kong privacy requirements.
Does an integration need maintenance after launch?
Yes. Credentials, APIs, fields, platforms, limits, business rules and data formats change. Maintain monitoring, alerts, an owner, manual fallback and periodic tests.
EXPERT AUTOMATION CONSULTATION
Want to confirm where your business should start?
Diagnose one real workflow first, clarifying value, risk, data, systems and the minimum viable scope before deciding whether to build.