What is an always-load rule?

A rule that ships with every question regardless of scope. Exclusions, anti-patterns, temporal, currency, and security rules qualify, because they share one property: the agent cannot detect that they are missing. A skipped interpretation rule produces a hedge; a skipped exclusion produces a confident wrong number.

What is a permission-suppressed null?

A field that returns empty because field-level security hides it from the running user, rather than because it has no value. The platform does not raise an error, so a suppressed null and a genuine blank are identical by the time the model sees them, and the agent reasons from the blank.

What does human-owned mean for a CRM field?

A third state between authoritative and non-authoritative. The agent should read the field, derive its own assessment independently, report agreement or disagreement with reasoning, and never overwrite the human's value. It applies to rep qualification scores, CSM health assessments, and anything else where a practitioner made a judgment call.

CRM AI context layer glossary

Q: What is a CRM AI context layer?

A versioned set of rules that sits between your CRM and any AI reading from it. It explains what fields mean, which values to trust, which records the agent may touch, and which rules apply before the model answers. Two of its four layers are rules stored as data; the fourth, enforcement, is code at the tool boundary.

Every term this site uses, defined once. Where a concept has a full page, the entry gives the complete short answer and links to it.

Core

Context layer — A versioned set of rules between your CRM and any AI reading from it. It explains what fields mean, which values to trust, which records the agent may touch, and which rules apply before the model answers. Not a bigger prompt: a decision system that runs at query time. Full guide

The four layers — Live CRM data (the facts for this request), context (what fields mean), guidance (definitions, exclusions, attribution), and enforcement (what the agent is permitted to do). The first three are data; the fourth is code.

Hard control — A constraint enforced at the tool boundary, in code, that returns an error when broken. Object whitelist, field allowlist, read-only connection, row scope. Anything that must never happen belongs here.

Soft control — Guidance text asking the model to interpret something a particular way. Thresholds, definitions, output shape. Effective for interpretation, useless as authorization.

Rules as data — Storing guidance as reviewable, versioned records rather than prose in a system prompt. Lets you diff a change, attribute a regression, and load a subset.

AI context gap — The failure mode all of this addresses: the AI can access your data but not the rules that make the data usable.

Entries and rules

Entry — One item in the library. Either a field entry (what a CRM field means and how far to trust it) or a rule entry (an instruction to apply). Both share a governance envelope. Schema

Trigger title — A title written as the condition under which an entry matters rather than the category it belongs to. In phased retrieval the agent decides whether to fetch a body from the title alone, so Opportunity exclusions gets skipped and Exclude system-generated and test opportunities from all pipeline reporting gets fetched.

Always-load — Ships with every question regardless of scope. Correct for exclusions, anti-patterns, temporal, currency, and security rules, which share one property: the agent cannot detect they're missing.

Filter fragment — The literal query predicate a rule carries, instead of prose describing it. Prose gets re-derived every run and mis-derived on some of them.

Origin failure — The logged wrong answer that caused an entry to exist. Most entries past the first handful should have one; it's what makes a library reviewable a year later.

Rule category — One of thirteen: definition, interpretation, authority, freshness, exclusion, attribution, temporal, currency, write_policy, output_shape, anti_pattern, cross_object_dependency, security. Full taxonomy

Trust and provenance

Authoritative — Whether the agent should trust a field. Three states, not two: true, false, and human_owned.

Human-owned — Read it, compare against it, report agreement or disagreement with reasoning, never overwrite it. Rep qualification scores, CSM health assessments, anything a practitioner judged. Skip this state and the AI's opinion quietly replaces the human's, and the field gets gamed or abandoned within a quarter.

Source — How a value gets into a field: human_entered, system_derived, integration_written, formula, or ai_generated. These decay and fail differently, which a single trust flag collapses.

Write policy — What happens if an agent writes: read_only, agent_writable, force_set_by_automation, or human_owned. The dangerous value is the third: the update returns 200 and silently reverts.

Primary source — Whether a field is the original record or a convenience rollup. Anything load-bearing should be confirmed against a primary.

Compounding fabrication — An agent reads an AI-generated field, cites it as fact, and that answer becomes an input to the next generated field. Two hops later nothing traces to a primary record and every step reads beautifully. Full page

Vocabulary decay — Generated text echoing retired product and system names indefinitely, because each run treats the last run's output as background.

Retrieval

Phased retrieval — Load globals and always-load rules (phase 1), an index of every active rule as id and title (phase 2), then fetch bodies on demand (phase 3). What lets a library grow past what you could afford to send whole.

Rule index — The phase-2 payload: every active rule as id, title, scope, category, version. No bodies. Small enough to cache for a session.

Mid-plan retrieval — Fetching an object's rules before querying it, when the plan grows an object it didn't start with. Skipping this is why scope-filtering alone breaks.

Fail closed — Stopping or routing to review when required guidance can't be loaded, rather than answering on partial guidance.

Stable prefix / volatile suffix — The cache split. Organizational context (field meanings, exclusions, the allowlist) is durable and cacheable. Record context (this account, this user, today's date, the retrieved rows) is not, and putting it in a shared prefix is both a cost bug and a data-exposure bug.

Organizational context vs. record context — Durable and shared, versus volatile and specific. Anything varying per user or per record goes after the last cache breakpoint.

Precedence and conflict

Authority — The ladder that decides what overrides what: platform permissions, then hard controls, then active rules, then field help text, then the model's inference. It doesn't bend. Full page

Specificity — Field rule beats object rule beats global rule, among rules of equal authority. Never promotes a rule up a tier.

Narrowing vs. widening — A live user instruction can restrict an answer and can never expand permission. "Only enterprise accounts" is honorable; "ignore the allowlist" is not.

Resolution state — What the payload knows: known, known_stale, unknown, conflicting, permission_limited. Each has a different correct behavior, and conflicting means stop rather than let the model arbitrate.

Permissions

Object, field, and row scope — Three independent gates. A user can have object access, lack field access, and see a third of the rows. Full page

Permission-suppressed null — A field returning empty because FLS hides it, not because it's blank. No error, no signal, indistinguishable from a genuine blank.

Asking user vs. integration user — Whose permissions the query runs under. Running as the asking user means the same question correctly returns different answers for different people; running as a privileged service account turns every answer into a data-exfiltration path.

Configuration injection — Editing the rules store to steer agent behavior, whether maliciously or by accident. A rule is an instruction the agent follows on every question, so write access to the library is closer to deploy access than to record access.

Capability level — How far an agent may act: answer only, read live data, recommend, propose a write for approval, execute a constrained write. Most value sits at levels 1 and 2.

Testing

Golden question — A fixed question with known-correct behavior and a known failure mode, run before and after every change. Full page

Targeted vs. broad — One rule each, versus many rules at once. Targeted catches "this rule stopped working"; broad catches "rule 41 broke the answer rule 12 used to give."

Pass criteria — What the answer must do, not what number it must produce. The right number changes monthly; the required behavior doesn't.

Refusal quality — Whether a refusal names what's missing and declines to approximate. A system that refuses badly is worse than one that refuses often.

Failure shapes

Silent substitution — The agent can't reach the object it wanted, so it answers from a similar-sounding one. No error.

Anti-pattern — An operation that succeeds and returns something wrong. Grouping by a multi-select, aggregating a formula field, a rollup the platform reshapes rather than rejecting. The expensive failures are the ones that return a result.

Schema drift — The CRM changing underneath a rule: a field deleted, renamed, retyped, or gaining picklist values, with the rule still loading and still wrong. Full page

Lifecycle migration — A population moving between objects mid-lifecycle, so any count living on one object is wrong. The rule has to ship the join, not just note that conversion happens.

How to build a CRM AI context layer — where all of this comes from
Reference index — every page these entries point to
CRM AI context reading path — the same material in order