How to give an AI agent access to your ERP or CRM without giving it admin
The short answer
Give the agent a separate identity, four permissions (read, draft, submit, never approve), a spend ceiling, an approval gate for anything that leaves the company, and a log outside the agent's reach. Then test revocation before you hand it a real record.
Why this became urgent this month
Oracle announced Oracle AI Workspace, which runs approved workflows across finance, procurement and planning from inside ChatGPT. IBM shipped agent identity, scoped credentials and a kill switch. US banks moved to block third party agents from customer accounts.
The direction is the same in all three: agents act inside systems that already hold the money and the records. The only question that matters is what they are allowed to do once they are in.
The four permissions, in plain terms
Read. The agent can see the records its job needs. An invoice triage agent reads open invoices. It does not read payroll.
Draft. The agent can create a record in a draft state. A draft purchase order, a draft reply, a draft ticket note. Nothing is committed.
Submit. The agent can move a draft into the queue that a human reviews. This is the permission most teams hand over too early, because it feels like the same thing as draft. It is not: submission is where the record starts moving through the business.
Approve. It should not have this. Ever, in the first version. Approval is the point where money leaves, a contract binds, or a customer is told no. An agent that can approve is a policy change, not an automation.
Scope by system, not by department
Write the permissions against tables and objects, not team names. "Finance access" means nothing in an audit. "Read and draft on purchase_orders where status = open, submit to the review queue, no access to vendors.payment_details" is a sentence you can defend.
Most ERPs expose exactly this granularity in their API scopes. The reason teams do not use it is time, not capability.
The spend ceiling
Give the agent a numeric ceiling per run and per day. Not because the model is careless, but because retries are cheap and loops are not. Two dollars per run, fifty per day, is a reasonable starting range for a single workflow agent.
When the ceiling trips, the agent should stop and leave a record, not fail silently. Silent failure is how you discover the problem from the invoice.
The approval gate that actually holds
Put the gate where the action leaves the company: an email out, a payment, a contract, a public post. Internal drafts can move freely. Anything external waits for a person.
Make the approver a named person per workflow, and make the queue visible. A gate nobody owns becomes a rubber stamp within two weeks.
Logs the agent cannot edit
Four fields per action: which agent, which object, which change, which outcome. Write them to a store the agent's credentials cannot write to. If the agent can modify its own trail, the trail is decoration.
Keep the last 90 days queryable. That covers the window in which most mistakes are found, and it is small enough to afford.
Revocation you have tested
Kill one credential on purpose and watch what happens. If the workflow keeps running, it is using another key you forgot about. If you cannot tell what stopped, you do not have visibility.
The enterprise version of this is a kill switch in the orchestration console. Your version can be a flag the runner checks at the start of every loop, and a documented way to flip it.
A worked example
Invoice triage agent. Reads open invoices and their line items. Drafts a coding suggestion and a matching purchase order. Submits both to a review queue owned by the AP lead. Cannot approve, cannot pay, cannot edit vendor bank details. Ceiling: two dollars per run, thirty per day. Log to the warehouse, not to the ERP.
That agent removes the reading and matching work, which is the bulk of the time, and leaves the decision with the person who is accountable for it. It is also the version that survives an audit.
Questions people ask
Can I use one integration user for all agents?
No. You lose attribution, and you cannot revoke one agent without breaking the rest.
What if the ERP only offers admin-level API keys?
Use a middleware layer that holds the admin key and exposes only the four operations above. It is one extra service and it is worth it.
How do I know the agent is working?
Pick one number before launch: cycle time, cost per case, or hours per week on that task. If it does not move in four weeks, stop the agent.
Read next: how to give an agent its own identity and what Oracle just shipped.