# Sage X3 Private AI Layer Blueprint Generator

> Source: https://netray.co/tools/sage-x3-private-ai-layer-blueprint-generator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Generate an architecture plan for adding a private AI assistant to on-prem Sage X3: SQL replica views, Syracuse SData and web services, retrieval, local GPU model, permissions and audit.

## Category

other-erp

## Erp

Sage X3

## Audience

- CIO
- IT manager
- ERP architect
- Security officer

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### Sage X3 version

**Key:** version

**Type:** select

**Options:**

- Sage X3 V7
- Sage X3 V11
- Sage X3 V12
- Not sure

**Default:** Sage X3 V11

#### Database engine

**Key:** database

**Type:** select

**Options:**

- SQL Server
- Oracle
- Other / not sure

**Default:** SQL Server

#### Hosting

**Key:** hosting

**Type:** select

**Options:**

- on-prem server
- private cloud
- air-gapped network

**Default:** on-prem server

#### Named users

**Key:** users

**Type:** number

**Default:** 200

#### Sites or plants

**Key:** sites

**Type:** number

**Default:** 2

#### Main use cases

**Key:** use_cases

**Type:** textarea

**Default:** Order and stock status questions, shortage summaries, supplier email drafts, and answers from procedures and certificates.

#### Data that must never leave the site

**Key:** never_leave

**Type:** textarea

**Default:** Customer pricing, drawings, personnel data and any export controlled or contract data.

#### GPU available

**Key:** gpu

**Type:** select

**Options:**

- None yet
- 1 x 24 GB GPU
- 1 x 48 GB GPU
- 2 x 80 GB GPUs
- 4 or more GPUs

**Default:** 1 x 48 GB GPU

#### Target go-live

**Key:** go_live

**Type:** date

**Default:** 2027-03-01

**Blocks:**

#### Private AI Layer Architecture Plan: Sage X3

**Body:** Company: {{company}}
Sage X3 version: {{version}}
Database: {{database}}
Hosting: {{hosting}}
Named users: {{users}} across {{sites}} site(s)
Target go-live: {{go_live}}

#### 1. Context and goal

**Body:** {{company}} runs Sage X3 and wants an AI assistant that answers questions and drafts work without moving data off its own infrastructure. The assistant is read-only by default and shows the query or API call behind each answer.

Main use cases:
{{use_cases}}

Typical Sage X3 questions cover order status by site, stock by location, work order progress and open purchase receipts, plus questions that need documents such as certificates or contracts.

#### 2. Components

**Table:**

**Columns:**

- Component
- Design for Sage X3
- Notes

**Rows:**

**0:** Data access path

**1:** Read-only replica of the X3 folder schema (ITMMASTER, SORDER, STOCK, MFGHEAD, PORDER) plus Syracuse SData reads for single records

**2:** Column allow-list with data dictionary descriptions

**0:** Retrieval index

**1:** Vector and keyword index over item sheets, certificates and contracts

**2:** Source permissions copied as metadata

**0:** Model serving

**1:** vLLM or Ollama on {{gpu}}, hosted {{hosting}}

**2:** Model sized for {{users}} named users

**0:** Tool server

**1:** Named read tools; drafts for writes

**2:** MCP-compatible with parameter validation

**0:** Identity and permissions

**1:** Directory user mapped to X3 user; site and legislation filters applied

**2:** Access codes and function profiles respected

**0:** Audit

**1:** Prompt, tool call, SQL or REST request, answer, approver

**2:** Sent to your log store

#### 3. Security controls mapped to your inputs

**Table:**

**Columns:**

- Requirement from your inputs
- Control
- Verification

**Rows:**

**0:** Data that must never leave the site: {{never_leave}}

**1:** Model and index run {{hosting}}; no outbound inference calls; egress blocked at the gateway

**2:** Firewall rule review and test with outbound traffic blocked

**0:** Named users: {{users}}

**1:** Directory sign-in; every call carries the asking user; rights applied as filters or by the system API

**2:** Test with users of different rights and confirm different answers

**0:** Database: {{database}}

**1:** Read-only replica or reporting copy; no write access for the assistant account

**2:** Attempt a write with the assistant login and confirm it fails

**0:** Sites: {{sites}}

**1:** Site and company limits applied to every tool call

**2:** Cross-site test queries

**0:** Writes

**1:** Only via supported APIs with named human approval; no direct database writes

**2:** Review the approval log for a sample period

#### 4. Three-phase rollout

**Table:**

**Columns:**

- Phase
- Scope
- Exit criteria

**Rows:**

**0:** Phase 1: read-only

**1:** Questions on core transactions, with the query shown. Pilot group first. GPU: {{gpu}}.

**2:** Answer accuracy checked against reports on a sample set; no permission leaks

**0:** Phase 2: drafts

**1:** Draft emails, summaries and transaction payloads; nothing sent or posted automatically.

**2:** Users accept most drafts with light edits; audit log complete

**0:** Phase 3: approved actions

**1:** Narrow set of low-risk actions through supported APIs with approvers. Write actions use X3 web services or SData create and update under the approver's identity, never direct SQL.

**2:** Rollback procedure tested; approvers named per action

#### 5. Open questions for IT

**Body:** 1. Which environments and companies or folders are in scope?
2. Can a read-only replica be created on {{database}}, and who owns it?
3. Which directory provides identity, and how are users mapped to Sage X3 users?
4. Where do documents and attachments live, and who controls their permissions?
5. Is {{gpu}} confirmed, and who hosts and patches the model server?
6. Which logs go to the SIEM, and how long are they kept?
7. Who approves each write action, and what is the rollback plan?
8. Does the plan need to be added to a security or compliance boundary before go-live on {{go_live}}?

#### Approvals

**Signatures:**

- Prepared by
- IT lead
- Security officer
- Business owner

**Notes:** Planning document, not a design guarantee. Model size, GPU count and index size must be validated with your own prompts and data. Verify table, API and version details against your Sage X3 documentation.

## Content

**Intro:** This generator turns a few inputs about your Sage X3 environment into a structured architecture plan for a private, on-prem AI assistant. It covers components, security controls, a three-phase rollout and questions for IT, ready to export and share.

**Sections:**

#### How to use it

**Body:** Fill in the company name, your Sage X3 version, database engine, hosting model, user and site counts, the main use cases, and the data that must stay on site. Pick the GPU you have or expect to buy, set a target go-live date, and the document updates as you type. Export to PDF or Word and circulate to IT, security and the business owner before any build starts.

**Bullets:**

- Be specific in the never-leave field; it drives the security table.
- Use the open questions section as an agenda for the first IT meeting.
- Re-generate after each decision so the plan stays current.

#### The design behind the plan

**Body:** The plan follows a common pattern: a read-only copy of the data, a retrieval index over documents, a tool server that exposes only approved read actions, an open-weight model served locally with vLLM or Ollama, and an audit log. Sage X3-specific choices are in the components table, including how to read records and how to apply user permissions.

#### How to read the result

**Body:** Treat the components table as the technical scope and the security table as the acceptance test list. The rollout table is deliberately cautious: phase 1 is read-only, phase 2 is drafts, and only phase 3 touches transactions. If your organisation is not ready for phase 3, stopping after phase 2 still delivers real value.

#### Common mistakes

**Body:** Skipping identity mapping, giving the assistant a broad service account, letting the model compose free-form SQL, and planning hardware before measuring prompts are the usual failures. Another is treating the model as an authority on arithmetic; totals should come from queries. The plan encodes the opposite choices.

**Cta:** Want this plan reviewed against your actual Sage X3 environment? Netray can review the blueprint with your IT team and partner and build the private AI layer on your own servers.

**Faq:**

#### Does this plan require internet access?

**Answer:** No. The design runs the model, index and gateway inside your network. For an air-gapped network, weights and containers are imported on approved media and there is no outbound route.

#### Is the assistant able to change data in Sage X3?

**Answer:** Read-only by default. Writes are limited to supported APIs, drafted by the assistant and submitted only after a named person approves them. Direct database writes are excluded.

#### How accurate are the hardware choices?

**Answer:** They are planning ranges. Use the sizing calculator and then test with your own prompts and document sizes before ordering hardware.

#### Can I share the output with auditors?

**Answer:** Yes, as a design starting point. It lists controls and verification steps. It does not assert any certification; your own compliance process decides what evidence is required.

## Search terms

Sage X3 AI architecture, Sage X3 on-prem AI plan, Sage X3 private LLM blueprint, on-prem AI architecture template, Sage X3 AI security controls, air-gapped ERP AI plan, ERP AI rollout plan template

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json