Why Agentic ERP Needs a Governance Layer - ERP Software Blog
Why Agentic ERP Needs a Governance Layer Before It Needs More AgentsMicrosoft’s 2026 release wave 1 pushed several finance agents — theSales Order Agent,Payables Agent, and Expense Agent in Business Central,. . .
Why Agentic ERP Needs a Governance Layer Before It Needs More AgentsMicrosoft’s 2026 release wave 1 pushed several finance agents — theSales Order Agent,Payables Agent, and Expense Agent in Business Central, alongside role-based Finance Agent capabilities in Microsoft 365 Copilot — from preview into general availability. For the first time, autonomous agents are creating purchase orders, matching invoices, and initiating approval workflows inside production ERP environments, not just summarizing data. That shift changes the job of every Dynamics professional who touches finance, supply chain, or compliance. The technical rollout is the easy part. The harder problem — and the one most implementations are currently skipping — is building the governance layer that determines what an agent is allowed to do, who is watching it in real time, and how its actions get audited after the fact. This article lays out a practical framework for that governance layer, grounded in what regulators, auditors, and early adopters are already requiring, and identifies the pitfalls organizations are hitting as they move agents from demo to daily use. The Business Challenge: Autonomy Arrived Faster Than AccountabilityEvery Dynamics 365 release cycle for the past two years has added more agentic capability. What’s different about 2026 wave 1 is that the agents shipping now aren’t advisory. The Sales Order Agent reads a shared mailbox and creates draft sales orders without a human initiating the task. The Payables Agent categorizes, reconciles, and routes invoices for approval. TheExpense Agentis explicitly built for non-ERP users — field staff, drivers, and occasional submitters — meaning the population of people whose actions touch the general ledger just expanded well beyond the finance team. This is a structural change, not a feature update. Traditional ERP controls were built around the assumption that a named human initiated a transaction and a second named human approved it. Segregation of duties, approval hierarchies, and audit trails all assume a person is the actor. When an agent reads an email, interprets intent, and drafts a transaction, the control model built for human actors doesn’t automatically transfer. Regulators are already responding faster than mostimplementation roadmapsaccount for. The EU AI Act’s high-risk obligations — which explicitly cover AI systems affecting financial decisions — phase in through 2026, with an August 2 activation date for high-risk category requirements. Those obligations require documented human oversight, record-keeping, and logging for exactly the kind of agent behavior Business Central andDynamics 365 Financeare now shipping as GA features. Meanwhile, auditors evaluating internal control over financial reporting (ICFR) are converging on a clear line: agentic AI is appropriate for Tier 1 activities — documentation drafting, evidence collection, program support — with full human review of outputs, but deploying an agent as an unsupervised Tier 2 control is being flagged as a material weakness in its own right. Put plainly: the compliance bar for agent-initiated financial transactions is being set right now, largely by people who have never opened Business Central. Dynamics professionals who wait for Microsoft or their auditor to hand them a template will be implementing governance retroactively, under regulatory and audit pressure, instead of designing it into the rollout. Expert Analysis: Three Governance Functions, Not OneThe mistake most organizations make is treating “AI governance” as a single checkbox — usually a policy document that gets written once and filed. In practice, effective governance over agentic ERP separates into three distinct functions, and each requires different tooling, different owners, and different cadence. Policy: What the agent is allowed to do before it actsThis is the permission boundary — transaction value thresholds, vendor allowlists, categories of expense the Expense Agent can auto-categorize versus escalate, and which customers the Sales Order Agent can draft orders for without a human touching the mailbox first. Policy has to be configured in the agent’s own environment (Business Central’s agent designer, Copilot Studio, or the relevant admin center), not bolted on afterward. Critically, policy should be narrower at go-live than the vendor’s default configuration suggests, with expansion happening only after a defined observation period shows the agent behaving predictably. Oversight: What the agent is doing in real timeThis is the layer most implementations underbuild. Oversight means someone — a named role, not “the finance team” generically — reviews agent-generated drafts before they post, monitors exception queues, and has a defined response time when an agent flags something it can’t resolve. For the Sales Order Agent and Payables Agent specifically, this means treating “agent creates draft, human approves” as a hard requirement during the first two to three months of production use, regardless of how confident the vendor demo made the agent look. Oversight also means monitoring for drift: agents that were accurate at go-live can degrade in accuracy as upstream data (vendor master records, customer email formats, expense categories) changes. Audit: What the agent actually did, after the factThis is the immutable log requirement that regulators and auditors are aligning on across the EU AI Act, NIST’s AI Risk Management Framework, and the OWASP LLM Top 10 — three frameworks built by different constituencies that all land on the same requirement: comprehensive, tamper-evident logging of agent decisions, inputs, and the human actions taken in response. For Dynamics environments, this means theenhanced MCP (Model Context Protocol)server logging capabilities shipping in 2026 wave 1 need to be turned on and retained, not left at default settings, and the retention period needs to match your industry’s audit cycle, not the platform default. Organizations that map these three functions separately — with separate owners, separate review cadences, and separate evidence trails — are the ones passing audit review on agentic ERP deployments without a scramble. Organizations that write one governance memo and consider it done are the ones generating findings. Practical RecommendationsStand up an agent inventory before the second agent goes live. You need a single register once you run the Sales Order Agent, Payables Agent, and Expense Agent together. Track what each agent can do and what data it touches. Track who owns its policy configuration and when someone last reviewed it. Most organizations can name their ERP modules easily. Few can name their active agents in one sitting. That gap is the first thing an auditor will probe. Assign a human owner to every agent, not every agent category. “Finance owns the Payables Agent” is not an assignment. A named individual who reviews exception queues on a defined schedule is. Rotate the assignment like any other control responsibility. Document the handoff every time. Set narrower policy thresholds than the default, and widen deliberately. Use the low-code agent designer to configure conservative transaction limits at go-live. Set approval triggers the same way. Treat threshold expansion as a change request with its own sign-off, not a settings toggle. Turn on and retain MCP server and agent activity logs from day one. Retroactive logging doesn’t exist. If an agent runs live for three months before you enable logging, that gap can’t close later. Fold the agent review into existing SOX or ICFR testing cycles. Don’t build a parallel process. Organizations tend to deprioritize separate “AI governance” workstreams against quarter-end deadlines. Folding agent oversight into existing control testing keeps it resourced. Pilot in a single business unit before enterprise-wide rollout. The Expense Agent’s target user is a non-ERP worker, like a field technician. That carries a different risk profile than back-office finance. Validate the control model with a contained population first. Open it to everyone with a mailbox only after that. Common Pitfalls to AvoidThe most common failure pattern is confusing agent accuracy with agent accountability. An agent that correctly drafts 98% of sales orders is still a governance problem if nobody can produce, on demand, a log of the 2% it got wrong and what happened next. Accuracy metrics belong to the vendor’s demo; accountability belongs to your control environment, and they are not the same conversation. A second pitfall is treating agent governance as an IT or security function only. Policy thresholds, exception handling, and audit ownership are finance and compliance decisions that happen to be configured in a technical interface. Organizations that route all agent governance decisions through IT without finance and internal audit at the table end up with technically sound configurations that don’t satisfy the control owners who have to defend them at year-end. A third, quieter pitfall is under-communicating the change to the people whose jobs the agents touch. When a Payables Agent starts routing invoices that a human used to route manually, the human’s role shifts from data entry to exception review — a different skill and a different sense of ownership. Implementations that don’t explicitly redefine those roles see either quiet resistance (people manually re-checking everything the agent does, erasing the efficiency gain) or the opposite failure (people rubber-stamping agent output without real review, which is worse). Future OutlookExpect the governance conversation to accelerate faster than the feature roadmap. Microsoft’s own certification path — major cloud providers including Microsoft are pursuing ISO 42001 AI management system certification — signals that enterprise procurement teams will increasingly require documented AI governance maturity from partners and internal teams alike before greenlighting further agent deployment. That means the organizations that build a defensible governance framework now have a compounding advantage: each new agent added in future release waves plugs into an existing control structure rather than requiring one built from scratch under time pressure. It’s also reasonable to expect audit and advisory firms to formalizeagentic ERPtesting procedures over the next 12–18 months, similar to how IT general controls testing matured after early ERP adoption two decades ago. Dynamics professionals who can speak fluently to policy, oversight, and audit — not just feature configuration — will be the ones trusted to lead these rollouts internally and advise on them externally. Key TakeawaysAgentic ERP features reaching general availability in 2026 wave 1 mark a shift from AI as an advisory tool to AI as a transaction-initiating actor inside core financial processes. Governance has to be treated as three separate functions — policy, oversight, and audit — each with its own owner and cadence, not a single document. Regulatory pressure, particularly the EU AI Act’s 2026 phase-in, and evolving ICFR standards are already defining the compliance bar for agent-initiated transactions, ahead of most internal governance programs. The organizations succeeding with these rollouts are pairing every new agent with a named human owner, conservative default policy, and immutable logging from day one — not retrofitting controls after the agent is already live in production. ConclusionThe technology question — can an agent read a mailbox and draft an accurate sales order — has largely been answered. The harder question, and the one that will separate confident agentic ERP adopters from organizations managing audit findings a year from now, is whether the control environment around that agent was designed with the same rigor as the agent itself. Building that governance layer isn’t a delay tactic or a compliance tax on innovation. It’s what allows the next agent, and the one after that, to be deployed with confidence instead of caution. FAQ SuggestionsQ1: Do agentic ERP features like the Sales Order Agent or Payables Agent require a policy change under the EU AI Act?If the agent affects financial decisions or outcomes, it likely falls under the EU AI Act’s high-risk category, which requires documented human oversight, logging, and record-keeping as obligations phase in through 2026. Q2: Should agent oversight sit with IT, finance, or internal audit?All three need a seat, but policy and exception review ownership should sit with the business function the agent serves (finance for Payables Agent, sales operations for Sales Order Agent), with IT providing the technical configuration and internal audit validating the control design. Q3: How is agentic AI treated differently from traditional ERP automation in an ICFR review?Traditional automation (workflow rules, approval routing) is deterministic and easier to test. Agentic AI is treated as appropriate for Tier 1 support activities with full human review; using it as an unsupervised control is increasingly flagged as a material weakness. Q4: What logging should be enabled before an agent goes live, not after?Comprehensive, tamper-evident logs of agent inputs, decisions, and the human actions taken in response — enabled from day one, since retroactive logging cannot recreate a gap once an agent has been operating without it. Q5: Is it safe to let non-ERP users like field staff submit expenses through an AI agent?It can be, but the risk profile differs from back-office users, so a contained pilot with tighter policy thresholds is recommended before rolling the capability out broadly.