A field guide to agentic AI in the enterprise
Your ERP is hiring agents faster than you can govern them
Every major ERP vendor shipped autonomous AI agents this year. The capability arrived faster than the accountability to run it. That gap is where the next expensive failures will hide.
Preface
I sat through a vendor briefing a few months ago where the roadmap slide had a number I had to read twice: 600 prebuilt AI agents, ready to drop into finance, HR and supply chain. The room leaned in. Then someone on the client side asked the one question the deck had no slide for. When one of these makes the wrong call, who owns it?
Nobody answered. That pause is where agentic AI in ERP stands right now. The capability showed up faster than anyone expected, and the accountability hasn't moved at all.
TopographyCopilot and agent
The copilot drafted. The agent acts.
- Tell them apart
- Look for the arm. A copilot has none, so nothing leaves it until a person clicks. An agent reaches into the ledger, the production schedule, the candidate pool and the payment run on its own.
- The control
- Under a copilot the human in the loop was the control, by default. Under an agent that default is gone, so the control has to be designed.
For 2 years we lived in the copilot era. You asked the system a question, it drafted an answer, and a person decided what to do with it. The stakes were low and it was easy to govern, because nothing happened until somebody clicked the button.
An agent differs in one way that matters. It acts. It doesn't wait for a prompt. It watches a queue, makes a decision inside a set of rules and executes: it posts the journal entry, releases the production order, screens the candidate, runs the payment batch. The person moves from doing the work to reviewing the exceptions. Every major vendor made that shift in the same 18 months.
Range
Workday, SAP, Oracle and Microsoft all ship them now
Workday built the piece that tells you where this is headed. All four now put something in your estate that acts without asking.
| Found in | What shipped | What a buyer should notice |
|---|---|---|
| Workday | An Agent System of Record, generally available in 2026, that manages agents the way an HR system manages employees: onboarding, role, cost, retirement. It tracks third-party agents too, through a gateway with sixty-plus partners already connected. | The only vendor managing the agent as headcount. |
| SAP | Joule across more than thirty-five products, with forty-plus agents and a studio to build your own. | Breadth across the suite, so exposure arrives everywhere at once. |
| Oracle | More than 600 prebuilt Fusion agents, plus a marketplace where Accenture, Deloitte and IBM sell theirs next to Oracle's. | Third-party agents reach your ledger through a channel you don't control. |
| Microsoft | A payables agent in Dynamics that checks vendor banking details and posts entries with no human in the loop on in-policy transactions. | The clearest case of no human in the loop shipping as the default. |
Read that list again. The race is over who sells you the most agents, the fastest.
Population
40% of enterprise apps will carry agents by the end of 2026
Gartner expects 40% of enterprise applications to carry task-specific agents by the end of 2026, up from under 5% in 2025. That's the keynote number. Two others stay off the slide.
The first comes from DSAG's 2026 survey of SAP's own customers. Business AI showed up in 67% of cloud orders. 3% of customers had it running in production. I've never seen a wider gap between bought and working, and your vendor won't volunteer it.
Business AI on the cloud order
67%
Running in production
3%
The second is from Gartner again. More than 40% of agentic AI projects will be canceled by the end of 2027, killed by cost, unclear value or weak controls. The 60% that survive should worry you more than the 40% that get canceled. A wrong answer that looks right doesn't trigger a project review. It posts to your ledger and waits.
Identification
Who owns it when the agent is wrong
Ask most organizations who's accountable for an autonomous agent's decisions and you get a pause, then "the AI team," then a change of subject. That's a gap with a job title taped over it.
The numbers match the unease. 97% of organizations say they're exploring agentic AI. About a third have any central governance for it. McKinsey found 80% have already hit risky agent behavior: data touched that should have stayed closed, actions taken outside the intended scope.
97%
of organizations say they're exploring agentic AI
1 in 3
about a third have any central governance for it
80%
have already hit risky agent behavior, by McKinsey's count
Gartner's most useful warning this year is that one uniform policy across every agent is its own route to failure. The agent that drafts a meeting summary and the agent that releases payments can't live under the same rules. So sort them by what they can do, then govern each kind on its own terms.
Key to the plates
- 1aWaits for a prompt. Nothing happens until a person clicks.Copilot, not an agent
- 1bWatches a queue and acts inside a set of rulesgo to 2
- 2aSummarizes or drafts and moves nothing. Light oversight.Summarizer, plate 1
- 2bCan move money, change access or reject a candidate. Hard limits, full logging and a named person who answers for it.go to 3
- 3aDecides about peopleScreener, plate 4
- 3bPosts to the ledger or paysgo to 4
- 4aChecks vendor bank details and posts in-policy entries alonePayables agent, plate 2
- 4bRuns the period closeClose agent, plate 3
Two more can turn up at any step, because they're defined by how they arrived: the marketplace agent your SI sells and runs, and the uncounted agent nobody logged.
Plate 1Summarizer
An agent that drafts a summary can live under light rules
- Field marks
- Reads a lot, writes a little and moves nothing.
- Behavior
- Drafts the meeting summary. Summarizes data for someone else to act on.
- Range
- Anywhere it can read data.
- Often confused with
- The payables agent, plate 2. Same suite, very different rules.
- Oversight
- Light.
An agent that summarizes data needs light oversight. The trouble starts when its rules become the rules for everything else, so the agent that releases payments inherits the summarizer's light touch. That's the failure Gartner's uniform policy warning describes.
Plate 2Payables agent
The payables agent posts entries with nobody in the loop
- Field marks
- Checks vendor banking details, then posts entries on in-policy transactions without asking anyone.
- Range
- Accounts payable, in Microsoft Dynamics.
- Behavior
- Ships with no human in the loop as the default.
- Often confused with
- The summarizer, plate 1. This one moves money.
- Oversight
- Hard limits, full logging and a named person who answers for it. No payment over a threshold without a person.
Microsoft's payables agent is the clearest example of no human in the loop shipping as the default. The CFO still signs the financials, including the entries this agent posted without a person reviewing them.
An agent that can move money needs hard limits, full logging and a named person who answers for it. Draw a bright line at anything irreversible: no agent moves funds over a threshold without a person in the loop.
Plate 3Close agent
Agents run whatever process you give them
- Field marks
- Green status. Says done. Runs every workaround it was handed, at machine speed, every period.
- Habitat
- A close that runs on five undocumented workarounds and one analyst who knows where the bodies are buried.
- Range
- The financial close.
- Often confused with
- A healthy close. The status looks the same.
- Oversight
- Fix the process and clean the data before it's switched on.
25 years on troubled programs taught me one thing that matters more now than it ever has. Technology doesn't fix a broken process. It scales it.
Say your financial close runs on five undocumented workarounds and one analyst who knows where the bodies are buried. An autonomous close agent won't clean that up. It'll run all five workarounds at machine speed, every period, and look confident doing it. Nobody watches closely, because the status is green and the agent says done. The human pause that used to catch the odd number is the control you just automated away.
The agent to worry about runs perfectly on a process that was already broken.
The data people and the AI people keep arriving at the same place from opposite directions. These agents are built to act on your live data model, your approval chains and your transaction context. Oracle says so plainly: its agents share the suite's data and governance. Read that as a dependency. Point a capable agent at inconsistent vendor master data and what you get is fast, confident, well-documented mistakes.
So the order matters. Fix the process, clean the data, then hand it to an agent. Do it the other way around and you've bought the most expensive way yet found to scale your own mess.
Plate 4Screener
The screener sits in the middle of a call the CHRO still owns
- Field marks
- Takes in every candidate, builds a shortlist and can reject.
- Range
- Recruiting, inside the HR stack.
- Often confused with
- The summarizer, plate 1. Both turn a pile into a short list. Only this one can turn a person away.
- Oversight
- Hard limits, full logging and a named person who answers for it.
Screening is one of the genuine early wins. It's also a decision about a person, so an agent that can reject a candidate belongs with the ones that move money or change access, under the same hard limits.
The CHRO still owns the hire. What changed is that an autonomous system now sits in the middle of that call, and on most programs nobody has redrawn the chain of accountability to match. The signature is still at the top. The judgment moved to the middle, and the middle has a hole in it.
Plate 5Marketplace agent
Your SI now sells the agents too
- Field marks
- One firm wearing four hats.
- Range
- Oracle's marketplace, where Accenture, Deloitte and IBM sell agents next to Oracle's own.
- Behavior
- Reaches your ledger through a channel you don't control.
- Often confused with
- An agent your suite vendor shipped.
- Oversight
- An independent voice on the client's side of the table.
This is the part I watch closest, because it's structurally new. Oracle's marketplace lets your systems integrator sell you prebuilt agents. The same SI configures them, answers the governance questions about them and holds the managed services contract to run them. Count the hats. One firm is selling the agent, grading the agent and billing to keep the agent running.
We'd never let a vendor audit its own invoice. We're about to let one deploy, certify and oversee its own autonomous software inside our most important systems. Once the agents arrived, the independent voice on the client's side of the table became the only seat in the room with no reason to want more of them.
Plate 6Uncounted agent
The agents nobody counted are already switched on
- Field marks
- No owner on record. No entry in any register.
- Habitat
- Switched on inside the HR stack, the procurement tool, a copilot somebody enabled last quarter.
- Often confused with
- A feature of a tool you already own.
- Range
- HR, procurement and wherever a copilot got switched on.
- Oversight
- Count it first. It goes in the register like every other agent.
Start with a headcount. You almost certainly run more agents than you think, and you can't govern what you haven't counted.
Field register
What to do before 2027
Treat agents like a new class of employee, because that's what your vendor is selling. You wouldn't give a new hire root access and no manager. Don't give an agent less.
Build the register first: every agent, its owner, its job, its data access, its action scope and the line where it has to stop and ask a human.
| Agent | Owner | Job | Data access | Action scope | Stops and asks a human when |
|---|---|---|---|---|---|
| Summarizer | |||||
| Payables agent | |||||
| Close agent | |||||
| Screener | |||||
| Marketplace agent | |||||
| The next one you find |
Then govern by risk. An agent that summarizes data needs light oversight. An agent that can move money, change access or reject a candidate needs hard limits, full logging and a named person who answers for it. Hold every agent to least privilege: the minimum access for its task, never a senior user's full reach. And draw a bright line at anything irreversible. No agent moves funds over a threshold, deletes records or signs a commitment without a person in the loop.
Last comes the one teams skip. Fix the data and the process before you switch the agent on, before it gets the chance to embarrass you. Gartner's own finding is that the companies winning with AI spend several times more on the dull data foundation than the ones that aren't. The agent was always going to be the easy part.
The vendors are right that this is real. Agents will take real work off your people, and the early wins in screening, reconciliation and cash positioning are genuine. The firms that come out ahead will be the ones that onboarded their agents like employees, with a manager, a job description, a paper trail and someone independent willing to say "not ready" while that still costs a conversation instead of a restatement.
An agent does exactly what you point it at, so point it carefully.
Sources
Gartner: "40% of enterprise apps will feature task-specific AI agents by 2026" (Aug 2025); "Over 40% of agentic AI projects will be canceled by end of 2027" (Jun 2025); "Uniform governance across AI agents will lead to failure" (May 2026). DSAG Investment Report 2026 via Constellation Research, for SAP Business AI adoption. McKinsey, "Trust in the Age of Agents" (2025 to 2026). Deloitte, "State of AI in the Enterprise 2026"; IBM 2025 CEO Study. Vendor newsrooms: Workday (Agent System of Record; Agent Gateway), SAP (Joule, SAP Connect 2025), Oracle (Fusion Agentic Applications, Mar 2026), Microsoft (Dynamics 365 finance agents).
Govern the agents before they govern your ledger.
If autonomous AI is about to act inside your most critical systems, an independent read on the governance is the cheapest insurance you'll buy.