[{"data":1,"prerenderedAt":347},["ShallowReactive",2],{"blog-\u002Fblog\u002Fconnecting-ai-agents-to-your-erp":3,"blog-related-\u002Fblog\u002Fconnecting-ai-agents-to-your-erp":326,"blog-surround-\u002Fblog\u002Fconnecting-ai-agents-to-your-erp":346},{"id":4,"title":5,"audience":6,"body":11,"cluster":280,"conversionGoal":281,"cornerstone":282,"date":283,"description":284,"draft":282,"extension":285,"factCheckedAt":283,"faq":286,"featured":282,"language":281,"meta":299,"minRead":300,"navigation":301,"order":302,"originalAsset":281,"path":303,"pillar":304,"primaryKeyword":305,"publicationOrder":306,"relatedProject":281,"releaseScope":307,"reviewCycle":308,"reviewMethod":309,"reviewStatus":310,"reviewedAt":283,"reviewedBy":311,"searchIntent":312,"seo":313,"sources":314,"stem":319,"tags":320,"type":324,"updated":283,"__hash__":325},"blog\u002Fblog\u002Fconnecting-ai-agents-to-your-erp.md","Should You Connect an AI Agent Directly to Your ERP?",[7,8,9,10],"enterprise-architect","transformation-lead","financial-controller","engineering-manager",{"type":12,"value":13,"toc":270},"minimark",[14,22,25,28,33,36,45,57,61,64,67,79,85,89,92,99,102,134,137,148,152,155,168,178,189,195,201,212,215,219,222,228,239,245,249,252,255],[15,16,17,21],"p",{},[18,19,20],"strong",{},"No — not directly. Put a service layer between the agent and the ERP that exposes a small number of narrow, logged, rate-limited operations, and connect the agent to that."," The reason is not that agents are dangerous. It is that \"connect it to the ERP\" means handing one non-human identity the union of authorizations a process touches, through an interface surface designed for trusted integrations, in a system where the licensing model is written around who creates documents.",[15,23,24],{},"If you search this question you will find a genuine split. Platform vendors say their ERP natively supports agents, which is true and getting truer. Practitioners in forums say, often in capitals, do not connect an agent directly to the ERP. Both are right, because they are answering different questions: one is about product support, the other is about what a credential can reach at three in the morning when nobody is reading the log.",[15,26,27],{},"I have spent eighteen years inside SAP FI and TRM — the authorization model, the posting architecture, the release strategies, and the interfaces that were already connecting non-human callers to ERP long before anyone said \"agent\". Three things a direct connection costs, in ascending order of how rarely they are mentioned.",[29,30,32],"h2",{"id":31},"_1-the-authorization-union-defeats-segregation-of-duties","1. The authorization union defeats segregation of duties",[15,34,35],{},"An agent asked to carry a process end to end needs every role that process touches: create the vendor, enter the invoice, release the payment. Each authorization check passes. The combination is precisely what a segregation-of-duties ruleset is written to forbid.",[15,37,38,39,44],{},"This is not a subtle failure. It is the oldest control in finance systems being satisfied step by step and defeated across the sequence, and it does not show up in an access review because non-human users are usually excluded from the human one. The detailed version — what lands on the document, what the auditor samples — is in ",[40,41,43],"a",{"href":42},"\u002Fblog\u002Fai-agents-in-sap-what-actually-posts","what an agent actually posts in SAP",".",[15,46,47,48,52,53,56],{},"The service layer fixes this by construction. If the agent can only call ",[49,50,51],"code",{},"propose_payment_batch"," and never ",[49,54,55],{},"create_vendor",", there is no union to review, because the union is the operation list and you wrote it.",[29,58,60],{"id":59},"_2-directly-usually-means-past-the-controls-not-through-them","2. \"Directly\" usually means past the controls, not through them",[15,62,63],{},"The second cost is about the route in. A direct connection tends to resolve, in practice, to one of two things: a write into the tables behind a document, or a read from a convenient copy — an extract, a warehouse table, an export somebody built years ago.",[15,65,66],{},"Both look like shortcuts and both are control failures. A table write skips validations, substitutions, the release strategy, number ranges and the change document, so the record exists and nothing records that it happened. A convenient copy carries its own scoping, usually looser and undocumented, and it is stale in a way the answer will not mention.",[15,68,69,70,73,74,78],{},"The rule I would apply without exception: ",[18,71,72],{},"an agent should be able to do nothing a person could not do through the front of the system, by that same route."," That is not a restriction on agents. It is the same rule every integration has been held to for thirty years, and the reason ",[40,75,77],{"href":76},"\u002Fblog\u002Fwhy-enterprise-ai-is-an-architecture-problem","the write path is an architecture decision"," rather than an implementation detail.",[80,81,82],"pull-quote",{},[15,83,84],{},"The question is not what the agent may do. It is what the agent may do next, and what it already did — because that sequence is the thing the control was written about.",[29,86,88],{"id":87},"_3-the-one-nobody-on-that-search-results-page-mentions-licensing","3. The one nobody on that search results page mentions: licensing",[15,90,91],{},"This is the cost I would raise first in a design review, because it is the only one that arrives as an invoice.",[15,93,94,95,98],{},"ERP licensing has had a long, expensive argument about ",[18,96,97],{},"indirect access"," — what you owe when something other than a licensed named user causes the system to do work. SAP's answer since April 2018 is the Digital Access model, and it is worth reading the shape of it carefully, because an agent fits that shape exactly.",[15,100,101],{},"From SAP's own public overview of the model:",[103,104,105,117,124,127],"ul",{},[106,107,108,109,112,113,116],"li",{},"It ",[18,110,111],{},"counts the creation of documents by indirect or digital access",", across ",[18,114,115],{},"nine document types"," — Sales, Invoice, Purchase, Service & Maintenance, Manufacturing, Quality Management, Time Management, Financial and Material.",[106,118,119,120,123],{},"Counting is ",[18,121,122],{},"on the initial document created",". In SAP's words, \"Read, Update, or Delete Documents are not counted.\"",[106,125,126],{},"Sales, Invoice and Purchase documents count at line-item level at a 1.0 multiplier; Financial and Material documents count at line-item level at 0.2.",[106,128,129,130,133],{},"The model was designed for exactly this class of caller. SAP's stated rationale is that it \"eliminates the need to count 'users' accessing ERP\" and ",[18,131,132],{},"\"addresses IoT cases (devices, bots, etc.)\""," — that phrasing is SAP's, from 2019, years before anyone was selling an agent.",[15,135,136],{},"Read those four points next to the thing you are about to build. An agent that creates purchase requisitions or financial postings through an interface is a non-human source creating counted documents, at a rate no human integration ever produced. Nobody notices during the pilot, because a pilot creates fifty documents.",[15,138,139,140,143,144,147],{},"Three honest caveats, because this is the part where confident writing does damage. Digital Access is ",[18,141,142],{},"optional"," for existing ERP customers — several licensing routes exist and you may already hold a different one. SAP's overview states on its own first page that it is informational, \"shall not be incorporated into any contract\", and subject to change, and it is now several years old. And your actual position depends on your contract, your region and how the landscape is licensed. None of that weakens the point, which is narrower and firmer: ",[18,145,146],{},"this is a question with a real answer, it is cheaper to ask before the build than after, and it is not on the architecture checklist you are using."," Ask your account team what an agent creating documents does to your position, and get it in writing.",[29,149,151],{"id":150},"what-connecting-it-properly-looks-like","What connecting it properly looks like",[15,153,154],{},"The service layer is not a new architectural idea. It is the integration layer you would have built for any other non-human caller, with a few properties made explicit.",[15,156,157,160,161,164,165,44],{},[18,158,159],{},"A small, fixed operation list."," Written by you, not exposed from the ERP's API surface. One verb, one scope each. ",[49,162,163],{},"read_open_items_for_vendor",", not ",[49,166,167],{},"query",[15,169,170,173,174,44],{},[18,171,172],{},"Its own identity, with the requesting human recorded."," Not a shared technical user — that is the decision that destroys attribution at the source and cannot be repaired afterwards. See ",[40,175,177],{"href":176},"\u002Fblog\u002Fagent-identity-and-permissions","who the agent is acting as",[15,179,180,183,184,188],{},[18,181,182],{},"A deterministic policy check in the path."," Thresholds, limits and approvals evaluated by code, not by a model that can be talked out of them. The model proposes; something that cannot be persuaded disposes. That component is ",[40,185,187],{"href":186},"\u002Fblog\u002Fthe-enterprise-ai-control-layer","the control layer",", and it is the whole difference between an instruction and a control.",[15,190,191,194],{},[18,192,193],{},"Rate and volume limits."," The characteristic agent incident is not one clever action, it is the same wrong action four thousand times before anybody looked.",[15,196,197,200],{},[18,198,199],{},"Idempotency on every write."," Agents retry. Retries duplicate. A duplicated payment instruction is a bad afternoon.",[15,202,203,206,207,211],{},[18,204,205],{},"Logging at the grain of the call",", with inputs. This is what makes the period-end conversation survivable, and it is the same requirement ",[40,208,210],{"href":209},"\u002Fblog\u002Faudit-trails-and-logging-treasury-systems","audit trails"," have always had.",[15,213,214],{},"There is a bonus that is worth more than it sounds: the layer is where your control environment lives, so changing agent platform becomes a technical decision instead of a re-negotiation with audit.",[29,216,218],{"id":217},"where-the-value-actually-is-anyway","Where the value actually is anyway",[15,220,221],{},"Worth saying plainly, because none of the above is an argument against using agents in an ERP context.",[15,223,224,227],{},[18,225,226],{},"Reading is underrated and it is where most of the return sits."," The friction in an SAP finance process is rarely the posting — it is establishing why something is the way it is: which document cleared this item, why this valuation moved, what the open items against this counterparty look like. An agent that answers those from the system of record, with document numbers attached, removes real hours, cannot corrupt anything, and under the counting rules above is not a document-creating event at all.",[15,229,230,233,234,238],{},[18,231,232],{},"Proposing is the useful middle."," Draft the posting, propose the clearing, prepare the payment run — and stop. A human releases. That is where ",[40,235,237],{"href":236},"\u002Fblog\u002Fai-workflow-teardown-bank-reconciliation","the bank reconciliation teardown"," lands too, and for the same reason: the release path is where the control lives.",[15,240,241,244],{},[18,242,243],{},"Posting directly is a narrow case."," High volume, low value, deterministic, with a tested reversal and a reconciliation that would catch a bad run. It is a small set, it is not where programmes should start, and it is the only one of the three that puts you inside the licensing question.",[29,246,248],{"id":247},"what-i-would-decide","What I would decide",[15,250,251],{},"Do not connect the agent to the ERP. Connect it to a service layer you own, with a written operation list, its own identity, a deterministic policy check, rate limits, idempotency and call-grain logging. Run the agent's composite authorizations through the segregation-of-duties ruleset you already have, and treat a conflict as a design defect rather than an exception to approve. Start on reading, move to proposing, and treat direct posting as a case to be argued rather than a destination.",[15,253,254],{},"And before any of that, ask the licensing question. It is the cheapest question in the programme and the only one that gets more expensive the longer you leave it — which is a fair summary of everything ERP has ever taught about indirect access.",[15,256,257],{},[258,259,260,261,265,266,44],"em",{},"See also ",[40,262,264],{"href":263},"\u002Fblog\u002Fenterprise-ai-agent-security-boundaries","security boundaries for enterprise AI agents"," and ",[40,267,269],{"href":268},"\u002Fblog\u002Fhow-ai-agents-fit-into-existing-enterprise-systems","how AI agents fit into existing enterprise systems",{"title":271,"searchDepth":272,"depth":272,"links":273},"",2,[274,275,276,277,278,279],{"id":31,"depth":272,"text":32},{"id":59,"depth":272,"text":60},{"id":87,"depth":272,"text":88},{"id":150,"depth":272,"text":151},{"id":217,"depth":272,"text":218},{"id":247,"depth":272,"text":248},"architecture",null,false,"2026-08-19","Practitioners say don't, vendors say it's supported. They answer different questions. Three things a direct connection costs — one of them commercial.","md",[287,290,293,296],{"question":288,"answer":289},"Should you connect an AI agent directly to your ERP?","Not directly, and the disagreement you will find online is really two different questions being answered at once. Whether an ERP platform supports agents is a product question, and the answer is increasingly yes. Whether you should point one at your ERP's interfaces with a broad credential is an architecture question, and the answer is no — because the agent then needs the union of the authorizations the process touches, which is the combination your segregation-of-duties ruleset exists to forbid. Put a service layer between them that exposes a small number of narrow operations, and connect the agent to that.",{"question":291,"answer":292},"What is the risk of giving an AI agent ERP access?","Three, and only the first is usually discussed. The authorization union: an agent carrying a process end to end holds roles no single person would be allowed to hold, so every individual check passes while the control fails across the sequence. The write path: an agent that reaches the tables or a convenient copy rather than the normal transaction path produces records with no validation, no release strategy and no change document. And the commercial one: an agent creating documents is a non-human source creating documents, which is exactly what indirect or digital access licensing is written about.",{"question":294,"answer":295},"Does an AI agent creating documents in SAP count as indirect access?","That is a contract question, not a technical one, and it deserves to be asked before the build rather than after. SAP's public description of its Digital Access model counts the creation of documents by indirect or digital access across nine document types, prices reads at nothing, and its 2019 overview explicitly frames the model as addressing non-human use — devices and bots. An agent creating purchase or financial documents through an interface has the same shape. Whether it is charged depends on your contract, which options you hold and how your landscape is licensed, so the honest advice is to raise it with your account team early.",{"question":297,"answer":298},"What sits between an AI agent and an ERP?","A service layer that exposes a deliberately small set of operations — not the ERP's API surface. Each operation does one thing at one scope, runs under the agent's own identity rather than a shared technical user, passes a deterministic policy check that a language model cannot argue with, is rate-limited, is idempotent so retries do not duplicate postings, and logs at the grain of the call. That layer is where the answer to every audit question lives, and it is also the thing that lets you change agent platforms without renegotiating your control environment.",{},9,true,2.2,"\u002Fblog\u002Fconnecting-ai-agents-to-your-erp","enterprise-ai-systems","connect AI agents to ERP",223,"The licensing section describes SAP's Digital Access model as SAP published it in a public May 2019 overview, which states on its own first page that it is informational, not part of any contract, and subject to change. It is not legal or licensing advice, commercial terms differ by contract and region, and Digital Access is one of several options an existing ERP customer may hold. Treat it as the question to raise with your account team, not as an answer.","annual","editorial-and-factual","reviewed","Tan Gravam","informational",{"title":5,"description":284},[315],{"title":316,"url":317,"release":318,"accessed":283},"SAP — Digital Access Adoption Program Overview (PUBLIC, May 2019): the nine document types, the counting rules, and the definition of Use","https:\u002F\u002Fnews.sap.com\u002Fwp-content\u002Fblogs.dir\u002F1\u002Ffiles\u002FDA_Offer_External-Master_V11_050619.pdf","May 2019","blog\u002Fconnecting-ai-agents-to-your-erp",[321,322,323],"enterprise-ai","ai-agents","sap","text","aLWPUx0jSQa5KSF0JTJfOUCdvConCCCQUZR0YCVddEQ",{"related":327,"prev":337,"next":339,"hasOrder":301,"place":341},[328,331,334],{"path":42,"title":329,"description":330},"AI Agents in SAP: What Actually Lands in the System","Role-aware is not segregation-safe. What an agent posting in S\u002F4HANA leaves on the document, in the release path, and in front of the auditor at period end.",{"path":176,"title":332,"description":333},"Agent Identity: Who Is the AI Acting As?","Delegated, shared, agent-specific or temporary — the four identities an AI agent can act under, and what each one costs you in attribution and blast radius.",{"path":263,"title":335,"description":336},"Security Boundaries for Enterprise AI Agents","An agent that reads untrusted content can be instructed by it. What the boundaries are, which of them hold under pressure, and which are theatre.",{"path":268,"title":338,"type":324,"language":281},"How AI Agents Fit Into Existing Enterprise Systems",{"path":186,"title":340,"type":324,"language":281},"The Enterprise AI Control Layer",{"label":342,"position":343,"total":344,"hub":345},"Architecture",3,6,"\u002Ftopics\u002Fenterprise-ai-systems",[],1787169867804]