Your ERP Is Hiring Agents Faster Than You Can Govern Them

I sat through a vendor briefing a few months ago where the roadmap slide had a number I had to read twice. Not a feature count. An agent count. Six hundred prebuilt AI agents, ready to drop into finance, HR, and supply chain. The room leaned in. Then someone on the client side asked the one question the deck had no slide for. When one of these makes the wrong call, who owns it?

Nobody answered. That pause is the whole state of agentic AI in ERP right now. The capability showed up faster than anyone expected. The accountability has not moved at all.

What actually changed

For two years we lived in the copilot era. You asked the system a question. It drafted an answer. A human decided what to do with it. Low stakes, easy to govern, because nothing happened until a person clicked the button.

An agent is different in one way that matters. It acts. It does not wait for a prompt. It watches a queue, makes a decision inside a set of rules, and executes. It posts the journal entry. It releases the production order. It screens the candidate. It runs the payment batch. The person moves from doing the work to reviewing the exceptions. Every major vendor made that shift in the same eighteen months.

Workday built the piece that tells you where this is headed. It shipped an Agent System of Record, generally available in 2026, that manages agents the way an HR system manages employees: onboarding, role, cost, retirement. It tracks third-party agents too, through a gateway with sixty-plus partners already connected. SAP’s Joule now runs across more than thirty-five products with forty-plus agents and a studio to build your own. Oracle announced more than six hundred prebuilt Fusion agents and a marketplace where Accenture, Deloitte, and IBM sell theirs next to Oracle’s. Microsoft shipped a payables agent in Dynamics that checks vendor banking details and posts entries with no human in the loop on in-policy transactions.

Read that list again. The race is not about whether agents work. It is about who sells you the most of them, the fastest.

The number nobody puts on the slide

Gartner expects 40% of enterprise applications to carry task-specific agents by the end of 2026, up from under 5% in 2025. That is the keynote number. Here are the two that stay off the slide.

First. In DSAG’s 2026 survey of SAP’s own customers, Business AI showed up in 67% of cloud orders. Three percent of customers had it running in production. I have never seen a wider gap between bought and working, and your vendor will not volunteer it.

Second, from Gartner again. More than 40% of agentic AI projects will be cancelled by the end of 2027, killed by cost, unclear value, or weak controls. The cancelled 40% is not the part that should worry you. The other 60% is. A wrong answer that looks right does not trigger a project review. It posts to your ledger and waits.

The dangerous agent is not the one that breaks. It is the one that runs perfectly on a process that was already broken.

Agents run whatever process you give them

Twenty-five years on troubled programs taught me one thing that matters more now than it ever has. Technology does not fix a broken process. It scales it.

Say your financial close runs on five undocumented workarounds and one analyst who knows where the bodies are buried. An autonomous close agent will not clean that up. It will run all five workarounds at machine speed, every period, and it will look confident doing it. Nobody watches closely, because the status is green and the agent says done. The human pause that used to catch the odd number is the control you just automated away.

The data people and the AI people keep arriving at the same place from opposite directions. These agents are built to act on your live data model, your approval chains, your transaction context. Oracle says so plainly. Its agents share the suite’s data and governance. That is a dependency, not a tagline. Point a capable agent at inconsistent vendor master data and you do not get intelligence. You get fast, confident, well-documented mistakes.

So the order matters. Fix the process. Clean the data. Then hand it to an agent. Do it the other way around and you have bought the most expensive way yet found to scale your own mess.

Who owns it when the agent is wrong

Ask most organizations who is accountable for an autonomous agent’s decisions and you get a pause, then “the AI team,” then a change of subject. That is not an accountability model. It is a gap with a job title taped over it.

The numbers match the unease. 97% of organizations say they are exploring agentic AI. About a third have any central governance for it. McKinsey found 80% have already hit risky agent behavior: data touched that should have stayed closed, actions taken outside the intended scope. Gartner’s most useful warning this year is that one uniform policy across every agent is its own route to failure. The agent that drafts a meeting summary and the agent that releases payments cannot live under the same rules.

The CFO still signs the financials. The CHRO still owns the hire. What changed is that an autonomous system now sits in the middle of those calls, and on most programs nobody has redrawn the chain of accountability to match. The signature is still at the top. The judgment moved to the middle. The middle has a hole in it.

Your SI now sells the agents too

This is the part I watch closest, because it is structurally new. Oracle’s marketplace lets your systems integrator sell you prebuilt agents. The same SI configures them. The same SI answers the governance questions about them. The same SI holds the managed-services contract to run them. Count the hats. One firm is selling the agent, grading the agent, and billing to keep the agent running.

We would never let a vendor audit its own invoice. We are about to let one deploy, certify, and oversee its own autonomous software inside our most important systems. The independent voice on the client’s side of the table did not get less useful when the agents arrived. It became the only seat in the room with no reason to want more of them.

What to do before 2027

Treat agents like a new class of employee, because that is what your vendor is selling. You would not give a new hire root access and no manager. Do not give an agent less.

Start with a headcount. You almost certainly run more agents than you think, switched on inside the HR stack, the procurement tool, a copilot somebody enabled last quarter. You cannot govern what you have not counted. Build the register first. Every agent, its owner, its job, its data access, its action scope, and the line where it has to stop and ask a human.

Then govern by risk, not by one rule for all. An agent that summarizes data needs light oversight. An agent that can move money, change access, or reject a candidate needs hard limits, full logging, and a named person who answers for it. Hold every agent to least privilege. Give it the minimum access for its task, never a senior user’s full reach. And draw a bright line at anything irreversible. No agent moves funds over a threshold, deletes records, or signs a commitment without a person in the loop.

Last, the one teams skip. Fix the data and the process before you switch the agent on, not after it embarrasses you. Gartner’s own finding is that the companies winning with AI spend several times more on the dull data foundation than the ones who are not. The agent was always going to be the easy part.

The vendors are right that this is real. Agents will take real work off your people, and the early wins in screening, reconciliation, and cash positioning are genuine. But the firms that come out ahead will not be the ones that deployed the most agents the fastest. They will be the ones that onboarded them like employees, with a manager, a job description, a paper trail, and someone independent willing to say “not ready” while that still costs a conversation instead of a restatement.

An agent does exactly what you point it at. Point carefully.