AI Agents in ERP, Three Months Later: The Agents Arrived. The Guardrails Are Still Catching Up.
A follow-up to our July 31 article on rules, trust and governed autonomy.
On July 31 we argued that the biggest obstacle to AI in ERP isn’t intelligence. It’s trust. Since then, the market has moved fast in one direction: the largest ERP vendors have started shipping agents inside their core products. The question for leaders is no longer whether agents will arrive in your ERP. It’s whether the controls around them will arrive first.
What Has Changed Since July
Vendors are shipping agents with governance features attached. At SAP Connect in early October, SAP said its new Joule assistants and agents, Joule Studio and Joule Work begin general availability this month, with tighter authentication, governance and identity management meant to keep agents within defined limits. SAP also reported that Joule Work is live with 110,000 of its own employees, with 20% productivity gains in finance, HR and procurement. Those are vendor-reported figures, so validate them against your own processes before planning around them.
Oracle is building the same way in NetSuite. NetSuite Next, announced in October 2025 and rolling out in phases, pairs the Ask Oracle assistant with SuiteAgent frameworks for custom agents and an AI Connector Service designed to let customers govern how AI interacts with NetSuite.
Regulators are shaping expectations. Singapore’s IMDA published a Model AI Governance Framework for Agentic AI in January 2026. It is voluntary guidance built around four dimensions: bounding risk, human accountability, technical controls and end-user responsibility. In the EU, the digital omnibus pushed high-risk obligations for standalone AI systems out to December 2027, but legal analysts describe that as deferral, not cancellation.
The Readiness Gap
Confidence is running ahead of controls. In a CIO Dive, OutSystems and KPMG survey of 858 executives, 82% believed their organization could keep pace with governing, integrating and monitoring AI agents. Yet only 26% said they were well prepared to resolve conflicts across agents, systems and workflows, and just 5% had automated controls, audit trails and formal human review points in place.
KPMG’s Michael Harper put the problem plainly: traditional logging and procedural governance were built for static software, not dynamic AI. The stakes are commercial as well as operational. Gartner predicted in June 2025 that more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value or inadequate risk controls.
Four New Accountability Gaps to Close
In July we described four pillars: SOPs, role-based permissions, human approvals and audit trails. Practitioners are now finding that agents stretch each of them. ERP security has long assumed that every action traces back to a human login. Agents break that assumption in four ways, according to analysis from Dynamics partner DAX Software Solutions:
- Traceability: agents can start multi-step sequences from an event, not a person’s login.
- Reasoning: audit trails often capture the outcome, but not the trigger, the data used or the reasoning path.
- Access: agents are often given broad ERP permissions instead of boundaries scoped to each agent.
- Drift and cascades: behavior can change after deployment, and chained actions can spread across records before anyone notices.
Where This Is Heading
The points below are our own outlook, based on the developments above. They are not forecasts from any single source.
1. Every agent gets its own identity. Google announced at Cloud Next ’26 that each agent on its platform gets a unique cryptographic identity for traceability and auditing. SAP highlights identity management for its agents, and Singapore’s framework points the same way. Expect “which agent did this?” to become a standard audit question.
2. Oversight moves into the runtime. Controls bolted on after deployment don’t scale. As KPMG’s Harper put it, assurance for agentic systems must be engineered from day one. Testing and validating agent behavior is already rated very or extremely important by 81% of surveyed executives when choosing platforms.
3. Autonomy becomes risk-tiered. Not every action deserves the same scrutiny. The practical model is to scale oversight with financial impact and reversibility: let agents act on low-risk, easily reversed work, sample the middle, and require approval for the rest.
4. Orchestration across systems becomes the hard problem. Seventy-one percent of surveyed executives expect applications to coordinate work across systems, teams and processes within five years, yet only 26% feel ready to resolve conflicts between agents. Agents from different vendors acting on the same invoice or purchase order will need shared rules about who wins.
5. Cost and compliance catch up. Analysts report that SAP’s agent runtime is free only through December 31, 2026, with later pricing undisclosed, so budget for agent usage before it becomes a surprise line item. On regulation, a deferred deadline is still a deadline: organizations that build audit and oversight now will have far less to retrofit later.
AI in Testing and Integration: Where the Rules Meet the Work
Governance gets the headlines, but two of the most practical uses of AI sit in delivery: testing and integration. They decide whether an ERP go-live or upgrade lands on time, and they are where the same rules apply in a different form.
Testing. AI is being used to generate test scenarios from business process and transaction data, scope regression by analyzing configuration and code changes, repair scripts that break when quarterly releases move screens and fields, and group failures by likely root cause. In June 2026, LG CNS launched an agentic testing product for SAP S/4HANA upgrades and go-lives, saying it cuts scenario design from days to a few hours. Its fully autonomous, multi-agent testing lifecycle is a stated plan for later this year, not something shipped today. The wider picture is similar: the World Quality Report 2025 from Capgemini, Sogeti and OpenText found nearly 90% of organizations pursuing generative AI in quality engineering, but only 15% at enterprise scale, with data privacy (67%), integration complexity (64%) and skills gaps (50%) the top barriers.
Integration. AI can draft field mappings and transformations from API documentation and schemas, generate integration tests, and triage failed messages. A newer pattern is exposing ERP functions to agents as governed tools through the Model Context Protocol (MCP). Integration vendors report that NetSuite’s AI Connector Service supports MCP, and their guidance is consistent: expose only approved endpoints, scope what each agent can call, and keep a record of every call. There is also a hard deadline in the background. Oracle has told NetSuite customers that SOAP web services will be removed in the 2028.2 release and that new builds should use REST with OAuth 2.0. For many teams, that is the natural moment to modernize integrations, using AI to speed up mapping and regression testing.
The rule from the rest of this article carries over: AI drafts, humans approve, pipelines prove. Give test and integration agents their own identities, keep them out of production unless a person approves the change, use masked data for test runs, and treat an AI-generated mapping for payments or tax like any other high-impact change that needs review.
What to Do in the Next 90 Days
- Inventory every agent running or planned in your ERP, including those switched on by vendor updates.
- Give each agent its own identity and least-privilege permissions, never a shared admin account.
- Tier your workflows by financial impact and reversibility, and set approval thresholds to match.
- Log the reasoning, not just the result: trigger, data inputs, decision path and the person or rule that authorized it.
- Test before and after every release, and keep a rollback path for anything an agent can change.
- Pilot AI in one test cycle or one integration, such as regression for your next quarterly release, and measure cycle time and defects that escape to production.
- Stay narrow: one workflow and one success metric, as we advised in July. Governance is far easier to prove on a single process than on twenty.
The Question Worth Asking
If an agent in your ERP made a wrong decision tonight, could you tell by tomorrow morning which agent acted, on what data, under whose authority, and how to undo it?
If you’re exploring practical AI solutions that deliver measurable business value, we’d welcome the conversation — connect with the Nexcen team.
