What does the agent need to know?
Can an AI agent safely read my company's ERP system?
The short answer
Yes, if you treat the agent like a new employee you do not fully trust yet. Give it its own account, let it read only, and let the ERP system itself decide what it may see. The danger is not that the agent reads your data. The danger is giving it more access than any person in that role would get.
Why connect it at all
An agent that cannot see your ERP system answers from guesses. Your clients, prices, stock and invoices all live there. So for most companies the real question is not whether to connect the agent, but how.
The agent gets its own account
Never let the agent sign in as a person. When it has its own account:
- You can always tell its actions apart from a person’s. Nothing it does is recorded under a colleague’s name.
- You can switch it off at once without locking anyone out of their work.
- Its permissions can be narrower than anyone’s. It sees what its task needs, not what its manager sees.
The ERP system enforces the rules, not the connection
Between the agent and your ERP system sits a piece of connection software. It is tempting to write the safety rules there: “this agent must not read salaries.” Do not rely on that. A rule written in the connection can be undone by a mistake in the connection.
Your ERP system already has a permission system, built and tested over years. Use it. If the agent’s account cannot see salaries, no clever question will reveal them.
Read first, write much later
Reading cannot damage a record. Writing can. Start with reading only, and stay there until you trust what the agent reads and what it concludes from it. Letting it create an order or change a price is a separate decision, made later, one kind of action at a time.
How we did it
When we connected AI to our own ERP system at OdooTec, we made four choices:
- Read only. Creating, changing and deleting records is planned for a later phase, not the first one.
- Its own account, with the ERP system’s own permissions. The connection does not decide what the agent may see. The ERP system does.
- A narrow scope. Our system holds more than one company. The agent’s account reads only one of them.
- We wrote down what we could not control. Some limits cannot be enforced perfectly. We listed those and accepted them knowingly, instead of pretending the connection closes every gap.
The question to ask your team
“If the agent asked our ERP system for every salary, every bank account and every client’s price, which of those would it get?” If the answer is “we would need to check,” the access is too wide.