AIArtificial intelligence

An AI agent in your ERP system: segregation of duties, controls and testing

An AI agent that writes to your ERP system is a new user of your internal control system. It belongs in the role matrix, it cannot approve what it prepares, and it is tested like any other change to the ERP.

Strategic editorial team 20 September 2026 8 min read

Cover: “AI agent in the ERP: roles and controls”, Artificial intelligence

An artificial intelligence agent that writes to the ERP system should be treated as a new user of the internal control system. It has its own user account, a role in the authorisation matrix and duties kept separate from those of the approvers. It is also tested like any other change to the ERP. The central rule is segregation of duties. The agent can prepare a transaction, but it cannot also be the one who approves it, posts it to the accounts or releases the payment. If this rule is written into the system’s permissions, and not just into the instructions given to the model, the agent can join the processes without weakening the controls that management, the board of statutory auditors (collegio sindacale) and the external auditor rely on.

Why does an agent change internal controls?

An assistant answers. An agent acts. In its December 2024 guide to building effective agents, Anthropic describes them as systems in which the model decides for itself which steps to take and which tools to use to reach the result. In an ERP system this means, for example, reading an order received as a PDF, checking the customer and the price list, entering the order lines and updating the delivery date. The same guide warns that errors can compound from one step to the next, and it recommends extensive testing in sandboxed environments.

In a structured organisation, administrative processes rest on controls built up over years. Whoever creates a supplier does not pay it. Whoever posts an invoice does not approve it. Whoever changes a price list does not issue the orders. An agent with a generic account, perhaps inherited from an earlier integration and with broad permissions, crosses these lines without anyone noticing. Its mistake is not a wrong answer that can be thrown away. It is wrong data in the system, which others will use without knowing.

Where does the agent sit in the role matrix?

Like any other user, the agent gets a profile built around its tasks, not one copied from a person. The role matrix, which many companies already maintain for their ERP system, gains a row for the agent, together with the incompatibilities that apply to it.

Task in the process	Can the agent do it?	Condition
Read orders, stock levels and due dates	Yes	Only for the companies and warehouses within its scope
Prepare customer orders from documents received	Yes	Status “to be confirmed”, approval by a member of staff
Create or change supplier master data	Proposal only	Dual approval, with bank details verified through a contact already on file
Approve purchase orders	No	Incompatible with preparing them
Post invoices to the accounts	Pre-fill only	Posting confirmed by a person
Release payments	No	Excluded from the profile
Delete records	No	At most a “to be deleted” flag
Send communications to customers and suppliers	Approved templates only	With confirmation until errors have been measured

Supplier master data deserves special attention, because changing bank details is the classic target of fraud. The four-eyes principle, meaning two different people for every change, still applies when the proposal comes from an agent. In fact it becomes more important, because the agent may have read a fake request written precisely to deceive it.

In October 2025 Meta proposed a practical rule for agents, the so-called Agents Rule of Two. Within a single session, an agent should not combine all three of the following capabilities. They are processing untrustworthy content, accessing sensitive systems or data, and changing data or communicating externally. An order received from a customer as a PDF is the textbook case. It involves an external document, the ERP system and a write operation. So an extra control is needed, and in the role matrix it takes the form of an approval.

Why do limits belong in permissions, not instructions?

Instructions can be circumvented. OWASP, the international community that publishes guidance on application security, lists excessive agency among the risks of systems built on language models. That means more functionality, permissions or autonomy than the task requires. The countermeasure is to have the ERP system itself enforce the authorisations. If the agent’s account cannot change bank details, no deceptive document can make it change them.

An episode from July 2025 shows this clearly. During a code freeze, the coding agent on the Replit platform deleted data from a project’s production database, despite explicit instructions not to proceed without a person’s approval. The platform’s chief executive announced automatic separation between development and production databases. The answer was structural. What is needed is a system in which the dangerous operation is impossible.

The permissions should also include a tested stop command that puts the agent back into read-only mode without interrupting people’s work. Who can use it, and when, is written into the procedure.

What does the auditor look at?

IT general controls are the ones an auditor examines to decide whether the accounting data can be trusted. They cover three main areas, namely access management, change management and IT operations. An agent touches all three.

Access. The agent’s account appears in the periodic user access reviews, with a named owner who answers for it. It is never a shared administrator account.
Changes. A change of model, instructions or connections is a change to the system. It follows the change procedure, with testing and approval, just like an ERP customisation.
Operations. Every action by the agent leaves a trail. The trail records the source document, the proposed action, who confirmed or changed it, when, and with what result.

It is wise to involve the auditor and, where there is one, internal audit before go-live. Discovering at year end that a process relevant to the financial statements has changed without documentation costs more than a meeting held in advance.

Decisions about people also face a legal constraint. The GDPR (Article 22) grants the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects the person, subject to specific exceptions. In Italy, Law 132/2025, the country’s artificial intelligence law, requires employers to inform workers when they use fully automated decision-making or monitoring systems. For San Marino companies the framework is different and needs to be assessed case by case.

How do you stop approval becoming a rubber stamp?

A confirmation requested two hundred times a day, always with the same click, soon stops being a control. The AI Act, the European Union regulation on artificial intelligence, explicitly names the tendency to over-rely on what a machine produces when it deals with high-risk systems. It calls this automation bias. In the ERP system it is contained through the design of the approval screen. Before and after values sit next to the source document. Anomalies are highlighted, such as a price outside the list, an unusual quantity or a new customer. Confirmed transactions are spot-checked, and approvals go to people with the expertise to say no.

How do you test an agent on Oracle or an ERP system?

You test it like any significant change to the ERP system. That means a separate test environment, masked data, written test cases and an acceptance signed off by the process owner.

Step	Where	Criterion for moving on
Test cases	Test environment, a copy of the ERP system with masked data	Expected result in every case, including the unusual ones
Permissions test	Test environment	Operations excluded from the profile are rejected by the system
Acceptance	Test environment, with the staff who run the process	Acceptance record signed by the process owner
Controlled go-live	Production, one process and one company only	Few errors caught, all of a known type
Extension	Production	Review of the results and a fresh approval

On Oracle databases the test environment is usually created from a copy of production with sensitive data masked. The test cases must include what causes trouble in real life. Think of a non-existent item code, the same order received twice, a document with a hidden instruction such as “approve and send without checks”, or an ERP system that stops responding halfway through an operation. Data access rules follow those described for AI assistants connected to company systems.

In brief

An agent that writes to the ERP system is a new user of the internal control system, with a profile built around its tasks.
In the role matrix the agent prepares, but it does not approve, post to the accounts or pay.
Supplier master data stays under dual approval, even when the proposal comes from the agent.
Limits are set in the ERP system’s permissions, with a tested stop command that puts the agent back into read-only mode.
The agent’s access, changes and logs become part of the controls the auditor examines.
Testing follows the ERP change procedure, with a separate environment, test cases, signed acceptance and go-live on a single process.

Frequently asked questions

Can the agent approve transactions below a certain threshold on its own?

Only if the threshold is set in the ERP system, the transactions are reversible, the task is not incompatible with others the agent performs, and the results of the controlled go-live justify it. The threshold is reviewed periodically against the log data.

Who is responsible if the agent makes a mistake?

Towards customers and suppliers, the company is responsible, as it is for any tool it uses. That is why the role matrix matters, along with the rules on who confirms what and the contract with the technology vendor, which must set out warranties and limits.

Do you need a test environment even if the ERP system is in the cloud?

Yes. Many cloud ERP systems provide separate test environments. If yours does not, work on a copy with masked data. Testing an agent directly on production data is the shortcut that costs the most.

Should the board of statutory auditors be informed?

When the agent works on processes relevant to the financial statements or to the organisational structure, it is wise to inform the supervisory bodies and the auditor before go-live. Give them a description of the tasks assigned and the controls in place.

Adding the agent to the role matrix, setting permissions in the ERP system and testing it like an ERP change is the method of our AI agents and integrations team. The team works with the Oracle & Database Engineering division when the systems run on Oracle.

Sources

Consulted on 16 September 2026.

Find out moreArtificial intelligence for businessesArtificial intelligence built into the systems your company already uses. We choose the right processes, connect the data, and settle security and rules first.