Operations

AI agents for ERP: automation with control

A practical guide to using AI agents in ERP without losing approval control, audit evidence, role security, or process ownership.

AI agents are becoming practical in ERP because they now sit close to the work that drains finance and operations teams: reading customer emails, interpreting attachments, drafting transactions, checking master data, and routing exceptions.

That does not make ERP a low-risk place to experiment. ERP is where invoices become liabilities, sales orders become commitments, stock promises become customer expectations, and supplier or bank changes can affect downstream payments.

A useful AI-agent roadmap therefore treats automation and control as one design problem. The aim is to remove repetitive handling while keeping accountable people responsible for approvals, exceptions, policy, security, and audit evidence.

What an ERP AI agent actually does

A basic assistant answers questions or drafts text. An ERP agent goes further: it can watch for work, interpret business documents, look up ERP records, prepare a transaction, ask for missing information, and route the result to a user or queue.

Microsoft Business Central Sales Order Agent is a useful example. Microsoft describes an agent that analyses customer email requests, identifies the customer, checks inventory, prepares quotes or orders, and keeps users involved for review and outgoing messages.

Business Central Payables Agent shows the accounts-payable pattern. Microsoft describes mailbox monitoring, PDF import into inbound e-documents, invoice extraction with Azure Document Intelligence, vendor identification, and supervisor review before the process continues.

NetSuite is taking a different but related path through its AI Connector Service. Oracle describes MCP-based AI client access to NetSuite data and functionality, including standard tools and the option to build custom tools under NetSuite permissions and controls.

SAP describes Joule Agents and SAP AI Agent Hub around cross-functional automation, discovery, deployment, and governance. Odoo documents invoice digitisation using OCR and artificial intelligence for vendor bills and invoices. The products differ, but the buyer question is similar: what can the agent touch, who reviews it, and how can the business prove what happened?

The best first workflows are document-heavy and repetitive

The strongest early candidates usually have repeated source documents, clear exception paths, measurable handling effort, and an existing human review point. They are not necessarily the flashiest workflows.

Email-to-order is a good sales-side candidate when customer purchase orders arrive by email with item references, delivery dates, attachments, and follow-up questions. The agent can prepare a quote or sales order, but commercial promises and exceptions still need review.

Email-to-bill is a good finance-side candidate because supplier invoices already pass through coding, matching, approval, and posting controls. An agent can reduce keying and first-pass matching effort without being allowed to approve or pay.

Shipping documents, receiving documents, remittances, claims, and reconciliations can also work well when the ERP already has clean reference data. Reporting agents are useful later, but only when metric definitions, data access, and role permissions are already disciplined.

Where control must stay explicit

Human review needs to be designed before the pilot starts. Decide which records an agent may draft, which fields it may update, and which actions it must never perform without a person.

Role permissions matter as much as model behaviour. Assign the agent only the access needed for the process, then review that access like any other privileged role. This is especially important when an agent can read customer, supplier, inventory, pricing, payroll, or payment-adjacent data.

Traceability is the practical audit test. The business should be able to connect the original email or document, extracted values, matching logic, exception reason, reviewer correction, approval, and final ERP record.

Exception queues should be boring and visible. Define what happens when the agent cannot identify a customer, item, vendor, tax code, bank account, price, order reference, or approval path confidently.

Segregation of duties still applies. Do not let one automation path create suppliers, change bank details, approve invoices, and release payments. The control model has to survive convenience pressure.

Cost and capacity need ownership. Some ERP agent usage is consumption-based, so a busy mailbox can create a transaction-volume cost pattern rather than a simple user-count cost pattern.

A practical controlled pilot sequence

1. Pick one process with high manual volume and visible exception rules, such as AP invoice intake or email-driven sales orders.
2. Document current volume, handling time, error types, rework, and approval points before enabling the agent.
3. Confirm which ERP records the agent can read, draft, update, or send for approval, and which actions remain blocked.
4. Test with messy real documents, not polished samples. Use partial orders, old supplier formats, missing references, duplicate invoices, out-of-stock items, and unusual email wording.
5. Measure successful drafts, exception rate, human correction effort, control issues found, usage cost, and support tickets.
6. Decide whether to scale only after process owners, finance, IT, and support can explain the operating model in plain language.

What partners and internal teams need to prove

ERP process knowledge is non-negotiable. The team must understand posting rules, order promises, inventory reservations, approval flows, GST and tax treatment, user roles, and audit evidence, not only prompts and integrations.

If an external agent or connector touches ERP data, the design needs monitoring, error handling, authentication, environment strategy, and support ownership. For native agents, the same questions still apply; they are just asked through the product configuration and release-management model.

Partners should also be realistic about data quality. Agents often expose bad item descriptions, stale customer contacts, weak supplier records, inconsistent coding rules, and ambiguous approval ownership. Those are business problems, not model problems.

Release management should include agent prompts, permissions, extensions, connectors, ERP releases, and regression tests. A useful partner can show how agent behaviour will be tested before each material process change.

Questions to ask before approving an ERP agent

• Which exact process will the agent handle, and what is outside its scope?
• Which ERP records can it read, create, update, approve, post, send, or delete?
• Which human reviews are mandatory, and can they be bypassed by configuration or role changes?
• Where are source documents, extracted fields, confidence signals, corrections, and reviewer actions stored?
• How are permissions, segregation of duties, audit logs, privacy, and support access reviewed?
• What happens when the agent is wrong, out of credits, disconnected, or overwhelmed by backlog?
• Who pays for usage, monitors monthly volume, and decides when to expand or stop?

What buyers should conclude

ERP agents are most useful where they remove repetitive handling from document-heavy workflows while leaving judgement and approval with accountable users.

The right first pilot is usually narrow. A small AP, sales-order, reconciliation, or document-matching pilot with strong controls is better than a broad agent programme that nobody can supervise.

ERP Search can help buyers clarify automation requirements and shortlist implementation partners, developers, integration specialists, or managed-support teams who understand both ERP controls and practical automation delivery.

FAQ

• Can AI agents replace manual ERP work? They can replace parts of manual handling, especially reading, drafting, matching, and routing. They should not replace business ownership, approval accountability, or exception judgement.
• Which ERP agent workflow should come first? Start with the workflow that has high volume, repeatable rules, good source documents, and clear review ownership.
• Are native ERP agents safer than external agents? Not automatically. Native agents may have cleaner product integration, while external agents may offer flexibility. Both need permissions, audit evidence, testing, and support ownership.
• What is the main risk? The main risk is uncontrolled automation inside a financial and operational system of record: wrong records, weak approval paths, poor traceability, over-permissioned access, and unclear support ownership.

Sources used

• Microsoft Learn, Sales Order Agent overview for Dynamics 365 Business Central.
• Microsoft Learn, Payables Agent overview for Dynamics 365 Business Central.
• Microsoft Dynamics 365 Business Central 2026 release wave 1 release-plan overview and planned-features pages.
• Oracle Help Center, NetSuite AI Connector Service and MCP Standard Tools SuiteApp documentation.
• SAP, Joule Agents and Joule Assistants; SAP Joule Studio product information.
• Odoo 19.0 documentation, Document digitization and Vendor bills.