An enterprise AI agent is software that reads your documents, checks them against your rules, cites the page behind each finding, and stops before any irreversible or high-consequence step until a named person approves it. BiltIQ Agent OS runs on your own GPU server with outbound calls blocked by default. 11 of its agents pass all 7 of BiltIQ's quality checks.
At a glance
| Point | Detail |
|---|---|
| What it does | Reads common formats including scans; tests clauses, amounts and dates against your checklist; cites the page |
| What it waits for | Irreversible and high-consequence actions pause for a named reviewer; with no approver, they are blocked |
| Where it runs | Your GPU server (Own it); outbound calls blocked by default (security gate, patent application 202631094208 filed) |
| Models | Open-weight, your pick; NVIDIA Nemotron by default for defence and PSU |
| Verified | 11 agents pass all 7 quality checks (of 97 built) |
| Proof | NHA PM-JAY AI Challenge 2026: won (hackathon), claim and bill verification, IISc Bangalore finale, 8 May 2026 |
| Price, ex-GST | Site licence ₹50–90 L one-time + ₹16–18 L a year managed service; paid pilot ₹5–8 L, credited |
How is an agent different from a chatbot or a script?
| Script | Chatbot | Enterprise AI agent | |
|---|---|---|---|
| Input | Fixed fields | Free text | Your documents, including scans |
| Output | Fixed action | A reply | Findings with the page cited, then a proposed action |
| Judgement | None | Unverified | Checked against your rules; budgets stop runaway loops |
| Consequential step | Runs | Not possible | Pauses for a named reviewer |
A chatbot answers. A script executes. An agent reads, checks, cites and then asks.
What are the parts of Agent OS?
- Manthan reads and retrieves documents, finds the passages behind each answer, with the page cited.
- Chat answers questions on your own documents, citing the source page.
- Flow runs multi-step workflows with approval steps built in. Budgets stop runaway loops.
- Connect links your systems over MCP; connectors are built per deployment.
- Voice adds a spoken channel into the same agents, included in the site licence.
- Approval inbox. A named reviewer accepts or rejects each finding. If no approver is available, the action is blocked.
- Security gate. Outbound calls are blocked by default. In on-prem-required mode no outbound host can be allowed.
Which 10 tasks run today, and where is the gate?
Tasks 1–5 are Agent OS workflows; 6–10 are Business OS copilot tasks that follow the same rule (the copilot proposes, a person approves).
| # | Task | The agent does | A person does |
|---|---|---|---|
| 1 | Tender scrutiny | Tests clauses, amounts and dates against your checklist; cites the page | Accepts or rejects each finding in the approval inbox |
| 2 | Contract review | Flags clauses that fail your rules, with the page | Decides the exception |
| 3 | Health-claim check | Checks the claim against policy and bills (PM-JAY AI Challenge 2026: won, hackathon) | Approves or rejects the claim |
| 4 | RFQ and supplier-quote check | Compares quotes against the RFQ terms | Picks the supplier |
| 5 | Cited answers from your files | Finds the passage and cites it | Uses the answer; nothing changes |
| 6 | Inbox to lead | Spots the enquiry, dedupes, assigns the owner, scores it | Approves the lead record |
| 7 | Reply draft | Writes the reply | Reads, edits, approves; only then it sends |
| 8 | Follow-up | Drafts after 3 days of silence, up to three | Approves each send |
| 9 | Business card to lead | Reads the card and builds the lead | Approves it |
| 10 | Won quote to client | Starts the onboarding checklist | Approves the client record |
The 11 verified agents are not listed by name on the site; the tasks above are what the product pages say they do.
Why is a rule in the prompt not enough?
"Do not send email without asking" in a system prompt is a request, not a control. A document can carry its own instructions and a model can drift. Agent OS puts the control under the model:
- Security gate. Outbound calls are blocked by default. In on-prem-required mode no outbound host can be allowed; other modes allow an admin allowlist, and you are shown the list. Patent application 202631094208 (fail-closed data boundary), filed Aug 2026.
- Approval, verified in code. Irreversible and high-consequence actions pause; with no approver they are blocked.
- Budgets. A workflow that loops stops at its budget.
How is a workflow built for your process?
Agents are not bought by the task name. They are built on your checklist, for your documents, in your deployment:
- Your rules. The checklist comes from you: the clauses, amounts, dates and certificates that matter in your tenders, contracts or claims.
- Your systems. Connect links the agent to your document store, ERP or mail over MCP. Connectors are built per deployment.
- Budgets and gates. Each workflow gets a budget so it cannot loop, and a named reviewer whose inbox receives every finding.
- Past files. The pilot runs the workflow on files with known outcomes and compares the findings with what your team found by hand.
What BiltIQ needs from you to start: past files with outcomes, the checklist, a named approver, and a GPU server or a BiltIQ loaner for the pilot. Everything runs on that server; with the gate on, nothing goes to an outside API.
When should you NOT deploy an AI agent?
- The process has no owner. Findings wait for a named reviewer; with none, the action is blocked and the work stops.
- You want it to act without asking. The pause is the product. An agent that signs, pays or sends on its own is not what Agent OS does.
- The documents are mostly handwritten. Scans are read; handwriting is weaker.
- You need a measured speed-up before you buy. BiltIQ quotes none. The paid pilot measures caught, missed and time per file on your own past documents, against your manual results.
What does "verified in code" mean in practice?
A rule in a prompt is text the model is asked to follow. A control verified in code is a check the software runs whether or not the model agrees: the gate consults the allowlist before any outbound call, the approval step consults the inbox before any consequential action. The difference matters when a document carries its own instructions or a model drifts after an update. The controls do not read the document; they read the configuration.
Frequently asked questions
What are AI agents with human approval?
Software agents that do the reading and checking, but stop before any irreversible or high-consequence step until a named person approves it. In Agent OS the findings land in an approval inbox; if no approver is available, the step is blocked rather than run.
Does Agent OS send our documents to a cloud API?
Not on an Own-it install. Outbound calls are blocked by default by the security gate, and an unconfigured install blocks all outbound calls. In on-prem-required mode no outbound host can be allowed.
How many agents does Agent OS ship with?
Each agent climbs 7 quality checks before BiltIQ relies on it; 11 of the 97 built pass all 7 today.
Related: Human-in-the-loop AI agents: which actions should need approval? · The 7 quality checks an AI agent passes before production · AI agents vs RPA: which fits which enterprise task? · On-premise AI contract review: clause checks that cite the page · Securing an AI agent connected to ERP, mail and documents · One agent can't do it: why orchestration matters
Next step: Agent OS; start with a 4–6 week paid pilot on your own past files (contact).
Facts checked against the BiltIQ product pages, 5 November 2026.