Agentic ERP

What is agentic ERP?

Agentic ERP is what you get when the ERP vendor puts AI agents inside the system, so that a step in a process runs without a person working through screens to make it happen. A supplier mails an invoice and a purchase invoice appears in the system, filled in. A reconciliation exception is raised and a suggested fix sits next to it. Nobody opened a page.

What changes is where the automation lives. Robotic process automation sits outside the ERP and drives it from the outside, clicking through the same screens a person would. An agent inside the ERP has an account in the ERP, permission sets in the ERP, and a task list a person can open. Microsoft's documentation is direct about it: the Payables Agent in Business Central "has a user account in Business Central, similar to other users".

One rule belongs at the top, because it does not bend. Segregation of duties and approval limits apply to an agent exactly as they apply to a person. An agent may not hold both halves of a segregated pair, and an amount that needs the managing director's signature still needs the managing director's signature. The four-eyes principle and segregation of duties entry goes into the duty pairs themselves. What is different here is only that one of the two parties is now a piece of software whose rights somebody granted one integration at a time.

Three different things get sold under this word

Ask three vendors what their agent does and you get three answers that share nothing but the word.

A copilot that answers questions about your data. You type "which customers are over their credit limit" and you get a list, a summary, or a suggested value on the screen in front of you. Microsoft's release plan for Business Central 2026 release wave 1 describes Copilot as a set of skills to "guide, find, compare, analyze, suggest, and summarize", and says everyone gets it with their licence at no extra cost. Exact's newest agents are the same shape: its Financial Agent, CRM Agent and Excel Agent are all question-answering and all marked beta on Exact's own AI page.

An automation that executes a defined step. Same input, same output, every time. Read the PDF, pull out the fields, map them to a ledger account using history, write the record. In release 26B, Oracle made Document IO, its generative-AI ingestion engine, the default for supplier invoice attribute recognition, replacing the older Intelligent Document Recognition backend. That is a better reader in the same slot, not a new decision maker.

An agent that decides between options. The system hands it a case, a set of allowed outcomes and some tools, and it picks. The Account Reconciliation Agent in Dynamics 365 Finance evaluates a reconciliation exception and recommends one action out of Create journal entry, Reverse, Link transactions or Accept without change. The Payables Agent in Business Central decides which ledger account a line belongs on, and decides when it is not confident enough to decide, at which point it stops and asks a person.

Only the third is new, and in every catalogue we have read it is the smallest part. That matters when you are signing something, because the number on the quote is usually an agent price for the second kind. The agent washing entry has the longer list of questions for that conversation.

An ERP copilot against an ERP agent

One dimension separates them cleanly. When it finishes, has anything in the system changed?

The only question worth asking about a demo is whether a record exists afterwards that did not exist before. The chat window, the reasoning summary and the confidence score are presentation.

What is shipping in September 2026, and what is not

Status matters more than the feature list, because the word agent reaches the slide long before the thing is generally available in your country and your language.

Microsoft, Dynamics 365 Business Central. The Payables Agent is generally available. It drafts supplier invoices and stops short of posting them, and its documentation, dated 3 May 2026 and updated 8 July 2026, carries a limitations list saying the agent does not support approval flows or anomaly detection. The Sales Order Agent always creates a sales quote first, because a quote "has no impact on planning, reservations, availability calculations, or cash flow forecasts", and it never mails a customer until a person has approved the message (documentation dated 21 July 2026). The Expense Agent went to public preview on 8 May 2026 with no general availability date, and its country list runs to ten. Belgium is not on it.

The status column reads the same higher up the market. The Account Reconciliation Agent in Dynamics 365 Finance sits in production ready preview, Microsoft has to switch it on for you by request, and it recommends an action only for voucher amount mismatches (documentation dated 16 June 2026, updated 1 September 2026). SAP's own post of 14 April 2026 lists the Dispute Resolution Agent for S/4HANA Cloud as a beta release. Oracle's four finance agents in Fusion release 26B work only where its generative AI services have reached your region. Exact, closest to home for a Belgian SME, names a Bank Agent, a Purchase Agent and a Debtor Agent on its own AI page, where the 98 percent accuracy and the fall of up to 20 percent in days sales outstanding are Exact's numbers about Exact's product.

What has actually shipped is step-level: matching a payment to an invoice, suggesting a ledger account, triaging an exception, drafting a document for a person to send. Those four are where the value is real today, and they are worth having. Fully autonomous end-to-end finance, the close that runs itself, lives on roadmaps and in keynotes and is not in a release note with a date on it. Microsoft even stops publishing its dated release plans from September 2026, so the table of preview and availability dates buyers have leaned on is going away.

Why the ERP is the right home for this, and the hardest one

Three things make an ERP the best place in the company to put an agent. The data is structured: an invoice line has an amount field and a VAT code, not a paragraph somebody has to interpret. The processes are defined: a purchase invoice already has a path through the system, with a status, an owner and a next step. And the volume is high enough for the arithmetic to work.

The same three things make it the hardest place, because every one of those defined processes ends in the general ledger. An agent that misreads a supplier mail does not send an awkward email; it books a cost on the wrong project, puts a VAT code on the wrong line, or opens the way to paying an invoice twice.

What makes it survivable is the permission model the ERP already has. Microsoft's agent permission documentation (dated 3 May 2026, still preview) sets the rule: a task runs on the intersection of the agent's permissions and those of the person who scheduled it, so "agents never exceed the privileges of the user who scheduled the task". Their own worked table has an agent that may read and modify customers but may not post sales orders, even when the person who started the task can. The interesting rights are the ones the agent does not have.

Segregation of duties applies to an agent exactly as to a person

Three ERP-specific things follow once you take that sentence seriously.

Approval limits do not move. An amount decides who signs, and an agent is not a signer. This is less of a fight than it sounds, because the accounts payable agent Microsoft ships for SMEs does not touch approvals at all: "Approval flows" sits on the Payables Agent's list of unsupported features. The agent fills the invoice in, and your approval workflow runs afterwards exactly as it ran before.

The pair an agent quietly collects is supplier master plus payment. The four-eyes entry names that pair as the first one any company should fix. What is specific to an ERP agent is that the software maker has already thought about it: when the Payables Agent creates a supplier, the Blocked field on the new vendor card is set to All, so no invoice processing can happen on that supplier until a person unblocks it, and the documentation says flatly that "The agent itself doesn't provide any capabilities for vendor approvals". That is the shape to demand from every other agent you switch on. The agent may create the record; a person makes it usable.

Identity is messier than the marketing. Two facts from the same Microsoft documentation set pull in opposite directions. The Payables Agent has its own user account with its own permission set, named PAYABLES AG. – RUN. And when a person activates it, "it runs as a background task in the context of that user" for mailbox access, while its effective rights are the intersection with whoever scheduled the task. So the honest answer to "whose identity does it act under" is: partly its own, partly the person who turned it on. That is a workable answer as long as everyone knows it, and a bad one if your audit file says the agent acts alone. The four-eyes entry covers what happens next, including the finding that matters most here: a second pair of eyes that has agreed with everything for six months is not a control, whether it is a model or a person who has stopped reading.

One supplier invoice, with the line drawn

A technical wholesaler near Hasselt, forty staff, about 450 supplier invoices a month, Business Central with the Payables Agent switched on. Here is the whole run and where the boundary sits.

1. The invoice arrives. Suppliers mail the accounts payable address as always. A rule moves those mails into an internal shared mailbox that the agent watches and that suppliers never see, which is Microsoft's own recommendation, so one of your own people is still the first pair of eyes on anything that looks like fraud.

2. The agent reads it. It creates an inbound e-document for each PDF attachment, extracts the content, and looks for the supplier in the vendor master.

3. The agent drafts the invoice. Ledger accounts, dimensions, VAT and line detail, using this supplier's own invoice history and your item references, with a note on each field saying why it chose that value. About 300 of the 450 come from twenty-five regular suppliers and go through with nothing to correct.

4. The agent stops when it is not sure. A new supplier, an unreadable scan, a PDF over ten pages. Roughly 40 a month land as a task for a person. If the clerk tells it to create the supplier, the new vendor card arrives blocked, and unblocking it is a human act on purpose.

5. The line. The agent finalises the draft into a purchase invoice and goes no further. It does not post, it does not approve, it does not pay. The invoice appears in the purchase invoice list, and your approval limits, your three-way match against the purchase order and the goods receipt, and Friday's payment run all work exactly as they did last year.

The arithmetic. Before, a clerk typed each invoice in about four minutes: 450 times 4 is 1,800 minutes, so 30 hours a month. After, 300 clean drafts get a one-minute glance, 110 need a field corrected at roughly two and a half minutes, and 40 are handled by hand as before at four minutes. That is 300 plus 275 plus 160 minutes, so 735 minutes, a little over 12 hours. The saving is close to 18 hours a month, around 800 euro at a loaded 45 euro an hour, against a metered credit cost per invoice you can size in advance, because trial mode gives you the first 50 invoices free before the meter starts.

Notice what did not change. The same person approves. The same threshold applies. Nobody's authority moved. The typing moved, and the queue in front of the person got shorter, which is the promise of agentic process automation stated one process at a time.

What to ask your vendor or your partner

Seven questions for the person selling it. Write the answers down with the date, because they change per release.

1. Which agents are included in my licence, and which are metered? In Business Central, Copilot comes with the licence and the agents draw on Copilot Credits billed by consumption, so it is a cost per invoice rather than a flat one.

2. What can each agent write, and what can it post without an approval? "It prepares the invoice" and "it posts the invoice" are two different products at two different price points, and the demo rarely makes clear which one you are watching.

3. Whose identity does it act under? Its own account, a service account, or the person who activated it. Ask for the permission set by name.

4. Where do I see what it did, and can my accountant read it a month later? A task pane a supervisor watches during the run is not a trail somebody can reconstruct afterwards.

5. Can I switch it off, including mid-task? Business Central got a stop-all-active-tasks action for a selected agent in April 2026. Watch the trap that comes with it: an agent that stopped because the credits ran out stays scheduled, and works through the whole backlog the moment credits return.

6. Is it generally available in my country and my language, today? Two Microsoft pages disagree as we write this. The availability table lists the Payables Agent and the Sales Order Agent for Dutch (nl-BE) and French (fr-BE), while the Payables Agent setup page says the agent is validated and supported in English in Australia, the United Kingdom, the United States and New Zealand. Ask for the row in the maker's own availability table, with the date you read it.

7. What has to be true in our data before this does anything? These features assume clean master data and approval workflows that already exist in the system, and a company without both buys a very expensive OCR. Microsoft is blunt about how strict the assumption is: "For security, the agent identifies contacts exclusively by matching the sender's email address to the E-Mail field on contact cards", so a contact card with an empty email field does not exist to the Sales Order Agent, and three vendor cards for the same supplier give the Payables Agent three possible answers. And if an invoice is approved today because the managing director walks past a desk and says yes, there is nothing in the system for the agent's output to flow into. Master data management and entity resolution come first, then the approval workflow, then the agent.