AI agents connected to the ERP: where it is safe to let them decide

An AI agent connected to the ERP reads data, prepares a posting, a reply or a document and, if it has permission, writes to the system. The question that matters is not whether the agent gets it right. It is which decisions can be handed to it without anyone seeing them first.

Our rule is short: AI proposes, a person approves at the critical points. The rest of the article explains how we decide what a critical point is and how that is written into the agent's configuration, not into a document of good intentions.

Three questions before granting autonomy

For each type of decision, we answer three questions:

• Is it reversible? A document classification can be corrected the next day. A payment or a change to a supplier's IBAN cannot be undone as easily.
• How much does a mistake cost? A 40-euro posting charged to the wrong cost centre does not carry the same weight as a 40,000-euro purchase order.
• Can it be checked by a rule? If a person would confirm the decision by comparing two values (the invoice with the order, the delivery note with the goods receipt), the agent can run the same check and show the evidence.

A decision that is reversible, low in value and checkable by a rule is a candidate for the agent to execute. If any one of the three is missing, it becomes a proposal that someone approves.

Permissions inherited from the user

The agent does not have a technical user with access to everything. It runs with the permissions of whoever invokes it, or of a profile created for it on the same design as people's profiles. If a person cannot approve an invoice above a certain amount in Sage X3 or PRIMAVERA, the agent working on their behalf cannot either.

This solves two problems at once. The agent does not open a side route around the authorisation rules the company already has, and the audit trail still answers the usual question: who did this, and with what authorisation.

Value and confidence limits

Each type of task has two configured limits. The first is a value limit: above it, the agent does not execute; it prepares a proposal. The second is a confidence limit: when reading a document is uncertain, or when the data does not match, the case goes to a person, whatever the value.

Limits start low and rise based on history. If, over several weeks, proposals of a given type are approved without corrections, it makes sense to extend autonomy. If corrections are frequent, the limit stays where it is and the problem is dealt with at source.

The validation queue

The human queue is where the agent's design is decided. A badly designed queue leads people to approve everything without reading, and then validation exists only on paper. To prevent that, each case in the queue shows:

• what the agent proposes to do, in ERP terms (posting, account, amount, document);
• the justification, with the data it relied on and the source of each item;
• the reason it came to the queue: value above the limit, low confidence or a failed rule;
• three actions: approve, correct and approve, or reject.

Corrections are the most useful data the process produces. They show where the agent fails and feed the review of the limits.

Logging

Each run is logged: the trigger, the data read, the proposal, the decision and who made it. With that log, the company can answer an auditor and measure the process: how many cases the agent resolved on its own, how many went to the queue and how long they waited.

Where we recommend the agent does not decide

• Payments and changes to customer and supplier bank details.
• Changes to master data with tax effect: VAT rates, exemptions, document series.
• Communications to third parties on the company's behalf without review, such as replies to complaints or sending documents to official bodies.

In these cases the agent is still useful: it gathers the data, prepares the proposal and explains it. The decision stays with the person accountable for it.

Sevways is part of the Anthropic Partner Network and uses this design in the agents we put into production on Sage X3, Cegid PRIMAVERA and clients' own systems.