For decades, the responsibility model inside ERP systems has been relatively straightforward. A person creates a transaction, another person may review it, an approval process may be triggered, and eventually the transaction is posted into the system of record. Whether the process involved a sales order, purchase order, journal, invoice, payment, or master-data change, there was usually a human being somewhere in the process who could explain what was entered, why it was entered, and who authorized it. That model is now beginning to change. Artificial intelligence is moving beyond helping users find information or draft content and is increasingly capable of performing multi-step business activities inside ERP systems. In Microsoft Dynamics 365 Business Central, the evolution has moved from Copilot assistance toward purpose-built agents that can interpret business requests, interact with Business Central, create or modify records, and involve people when approval or additional information is required. Microsoft’s current direction includes Sales Order Agent capabilities, custom agent design, agent permissions, agent testing and evaluation, and model management, which makes the question of responsibility much more important than it was when AI was simply answering a user’s question.
The interesting part of this transformation is not that an AI agent can create a sales order. Technically, that is becoming increasingly achievable. The more important question is what happens when the agent creates the wrong sales order. Imagine a customer sends an email requesting 100 units of an item, but the agent identifies the wrong customer because two customers have similar names, selects an incorrect unit of measure, interprets the requested delivery date incorrectly, or chooses an item that appears to match the description but is not the intended product. The transaction may be technically valid from the perspective of Business Central, yet completely wrong from the perspective of the business. This is where the conversation around AI in ERP needs to mature. The challenge is no longer simply whether an AI agent can perform an operation; it is whether the organization has designed the surrounding architecture so that the operation can be trusted, validated, traced, corrected, and appropriately authorized.
The ERP Responsibility Model Is Changing
The traditional ERP model was built around human accountability. A user logged into Business Central, performed an operation using their permissions, and the resulting transaction could be associated with that user. The system could record who created or modified a record, who posted it, and which approval workflow was followed. This did not make traditional ERP processes error-free, because people have always made mistakes, but the responsibility chain was relatively easy to understand.
Agentic ERP introduces another participant into that chain: the AI agent.
That creates a new question for enterprise architecture: what does it mean for an AI agent to become an operational actor inside an ERP?
This is not merely a philosophical question. Microsoft already documents agents as operating with their own user identity and permissions in Business Central, with actions attributable to the agent’s user ID, while also providing mechanisms for human intervention, approvals, timelines, and visibility into agent activity.
The significance of this is easy to underestimate. When AI only provides a recommendation, the user remains the obvious decision-maker. When AI creates a transaction, the system has moved into a different territory because the output is no longer just information; it becomes a business record that can affect inventory, revenue, purchasing, customer commitments, financial reporting, and downstream processes.
The moment AI can change the state of an ERP, AI governance becomes operational governance.
From “AI Can Answer” to “AI Can Act”
The first generation of enterprise AI was largely evaluated by the quality of its responses. Was the answer useful? Was the generated text accurate? Did the summary save the user time?
Agentic systems require a different standard. The question becomes whether the agent completed the intended business task correctly. That means evaluating the entire chain of behavior: whether the agent understood the request, retrieved the correct information, selected the correct records, applied the right business logic, performed the correct actions, respected its permissions, handled exceptions correctly, and left the system in the expected state. Microsoft’s current Business Central tooling reflects this change, with agent testing designed to evaluate end-to-end task execution rather than simply checking the quality of an AI-generated response. This is a significant shift in how we should think about AI quality.
For a chatbot, an incorrect answer may be inconvenient. For an ERP agent, an incorrect action can become a transaction.
That means AI evaluation has to move from language quality toward business outcome quality.
A Valid Transaction Can Still Be a Wrong Transaction
One of the most important concepts for ERP agents is that technical validity does not equal business correctness. Business Central can validate whether a transaction satisfies the rules required for the transaction to be accepted. It can check fields, posting setup, dimensions, inventory conditions, permissions, and other configured rules. But an AI agent can still make a mistake before those validations even become relevant.
It can choose the wrong customer. It can choose the wrong item. It can misunderstand the user’s intent. It can interpret an ambiguous instruction incorrectly. It can use information that is technically available but not relevant to the specific business decision.
The ERP may then accept the transaction because the transaction is structurally valid. This creates an important distinction between system validation and business validation.
System validation asks:
Is this transaction allowed?
Business validation asks:
Is this actually what the business intended?
The second question is where AI agents need additional controls.
Human in the Loop Is Not a Weakness
There is sometimes an assumption that the ultimate goal of AI automation should be to remove humans from the process. In ERP, I believe that is the wrong way to think about autonomy. A well-designed agent should remove unnecessary human effort while preserving human judgment where the consequences justify it.
Consider a sales order agent that receives an email, identifies the customer, checks item availability, prepares the order, and presents it for review. The AI has already removed a significant amount of repetitive work, but the human has not been removed from the process entirely. Instead, the human’s role has changed from data entry to validation and decision-making. This is a much more valuable form of automation.
Microsoft’s Sales Order Agent documentation provides a practical example of this approach, describing human intervention for important operations and communications, approval workflows, detailed task timelines, review of changes, and attribution of actions to the agent’s user identity.
The objective should therefore not be:
“How do we eliminate the human?”
It should be:
“Where does human judgment create the most value, and where is human involvement simply repetitive administration?”
The Five Controls Every ERP Agent Needs
If AI is going to become an operational participant in Business Central, I believe five areas need to be treated as foundational rather than optional.
Context
An agent needs the right business context before it acts. General model knowledge is not enough. The agent may need current customer information, item information, transaction history, business policies, configuration, documentation, and organizational knowledge. An intelligent model without the right context can still produce the wrong outcome.
Permissions
An agent should not automatically inherit unlimited access simply because it is technically capable of performing an operation. Business Central’s current agent architecture treats agents as users that can be assigned permissions and profiles, which provides a foundation for controlling what an agent can access and do.
Business Rules
AI should not replace deterministic ERP rules. It should operate within them. Posting rules, approval policies, transaction limits, segregation of duties, and other controls should remain enforceable by the system rather than relying on the AI to remember or interpret them correctly every time.
Approval Boundaries
The organization needs to define which actions require human approval and under what circumstances. Approval should not be an afterthought added when something goes wrong; it should be part of the agent’s operating model.
Auditability
Every significant action needs to be traceable. Organizations should be able to understand what the agent did, what it changed, what information it used, where human intervention occurred, and what the final outcome was. Current Business Central agent capabilities already emphasize task timelines, change visibility, agent identity, notifications, and approval workflows, showing how central transparency becomes once AI is allowed to act.
Testing an Agent Is Different From Testing Traditional Software
This may be one of the biggest changes for Business Central developers and architects. Traditional software testing generally assumes deterministic behavior. Given the same input and environment, the system should produce the expected result. AI agents introduce non-deterministic behavior, which means testing cannot be limited to a few successful demonstrations. Microsoft’s current guidance explicitly recommends systematic testing for agents, including different input formats, edge cases, error conditions, human errors, and consistency of behavior, and recommends thorough sandbox testing before production deployment.
This means organizations need to think in terms of evaluation suites and scenarios, not just test cases. For a sales-order agent, for example, testing should not only ask whether a straightforward order was created correctly. It should also test ambiguous customer names, missing quantities, unknown items, multiple units of measure, incorrect delivery dates, conflicting information, unavailable inventory, unusual customer requests, duplicate orders, and situations where the agent should stop and request human input.
The real test is not:
“Can the agent create an order?”
The real test is:
“Does the agent know when it can safely create an order, when it needs more information, and when it should stop and ask a human?”
That is a much higher standard. Automation asks whether a sequence of steps can be executed automatically. Agentic architecture asks whether a system can understand an objective, make decisions within defined boundaries, perform the necessary actions, recognize uncertainty, and escalate when it reaches a situation outside those boundaries. That requires a different level of trust and trust cannot come from the AI model alone. Trust comes from the architecture surrounding the model.
The Future Is Not Fully Autonomous ERP
I don’t believe the destination should be an ERP in which humans disappear from every process. The more realistic and valuable future is an ERP in which human attention becomes concentrated around exceptions, judgment, relationships, strategy, and accountability, while AI agents increasingly handle repetitive operational work and continuously monitor processes for issues that would otherwise consume human time. The user who once spent twenty minutes creating a transaction may instead spend two minutes reviewing an AI-prepared transaction.
The consultant who once spent hours investigating a recurring operational problem may instead receive an agent-generated diagnosis with supporting evidence. The finance professional who once manually reviewed every routine exception may increasingly focus on the transactions that actually require judgment. The value of AI is therefore not simply that it can perform more tasks. The deeper value is that it can change what humans spend their time doing.
So, Who Is Responsible When AI Gets It Wrong?
The answer cannot simply be “the AI.”
An AI agent does not carry organizational accountability in the way a person or business does. Responsibility ultimately belongs within the operating model of the organization that designed, configured, authorized, and deployed the agent. That means accountability must be distributed deliberately across the architecture: the business owner defines the acceptable outcome, the solution architect defines the operating boundaries, the development team builds and tests the agent, administrators control permissions, users provide approval where required, and the organization establishes governance for monitoring and continuous evaluation.
The important point is that responsibility cannot be added after deployment.
It must be designed into the agent before the agent is allowed to act.
This is why the most important question about agentic ERP is not whether an AI agent can create the transaction. We already know that direction is becoming real. The important question is whether we are building the controls, architecture, testing, governance, and accountability required to trust the transaction once the AI creates it.
The evolution of Business Central is therefore not simply a story about smarter software. It is a story about a new relationship between people, business processes, deterministic ERP systems, and probabilistic intelligence.
Copilot changed how users interact with the ERP. Agents are beginning to change who performs the work. The next stage will determine how organizations define trust around that work and perhaps the most important principle for the agentic ERP era is this:
Don’t ask only what AI can do. Ask what AI should be allowed to do, under what conditions, with what evidence, and with whom accountable for the outcome.
That is where AI innovation becomes enterprise innovation.