An agent that reads your ERP is a search problem. An agent that writes to it is a control problem. The moment a language model can create a purchase order, change a customer credit limit or close a ticket, the question stops being how well it reasons and becomes who authorised the change, what they saw when they authorised it, and what record survives six months later when finance asks.
THE SHIFT
What Changes When An Agent Gains Write Access
A read-only agent that is wrong wastes a person’s time. A write-capable agent that is wrong creates a transaction with your company’s name on it, inside a system other people trust. The failure is silent because the record looks like every other record.
This is the difference between a pilot and a production system. Retrieval over your own documents has a bounded downside: a bad answer gets corrected by the person reading it. A write operation propagates. A duplicated supplier invoice enters the payment run. A record change updates a field that three downstream reports aggregate. Reversal is possible in most business systems, and it is rarely clean, because the compensating entry is itself an event with a date on it.
Model Context Protocol is the reason this question arrived on so many roadmaps at once. MCP standardises how a model discovers and calls tools, which is what makes connecting a model to ERP, CRM, ticketing and document systems a matter of weeks. The protocol’s own specification is explicit that the standard does not solve the permission question for you: it states that there should always be a human in the loop with the ability to deny a tool invocation, and that the calling application is responsible for presenting that decision clearly. The US Department of Defense published MCP security design guidance in June 2026 making the same point about transactional tools. The protocol moves data. Your architecture decides what the agent is allowed to do with it.
SCOPE
What An Agent May Do Without Being Asked
The workable line sits between preparing a change and committing it. An agent can read, query, join, calculate, draft and stage without supervision, because every one of those actions is reversible by discarding the draft. Committing to a system of record requires a person.
ARSA builds every agentic workflow this way. Connectors are read-only by default and each write is staged for explicit human approval before commit. There is no autonomous write mode to switch on, which matters most in the eleventh week of a project when someone asks whether the gate can come off for the simple cases to hit a go-live date. A control that can be configured away under delivery pressure will be.
Defining the boundary is the first hour of design work, and it is specific to your processes. Creating a draft quotation is staging. Emailing that quotation to the customer is a commit, because you cannot unsend it. Writing a meeting summary into a CRM note field is low consequence. Changing the opportunity stage that drives the sales forecast is a commit that someone owns. The useful test is whether an action changes something another person or system will act on before a human looks at it again.
THE RECORD
What A Usable Audit Trail Actually Contains
An audit trail that logs only the final write is a list of changes with no explanation attached. Reconstructing a decision afterwards needs three separate records, captured at three different moments.
What The Agent Proposed
The full proposed transaction, field by field, with the retrieved documents, records and tool responses the agent used to build it, and the prompt and tool call that produced it. Stored before the approval is sought, so the proposal cannot be edited after the fact to match the outcome.
What The Approver Saw
The rendered payload presented for approval, the identity of the person who decided, the timestamp, the decision, and any edits they made to the fields before committing. An approval log that records consent without recording what was on screen proves that a button was pressed.
What The System Committed
The write as the target system accepted it: the returned record identifier, the version or revision, the response code, and the diff against the previous state. This is the record that reconciles against your ERP’s own history, and the one that makes a discrepancy visible.
DESIGN VALUES
Approval Tiers And Retention, As Design Inputs
The gate applies to every write. How much friction sits on top of it is a per-action decision, made during the assessment and written down. These are the defaults ARSA works from, and they are adjusted against your processes and your auditors’ expectations.
| Design parameter | Default | Reasoning |
|---|---|---|
| Write operations permitted without human commit | 0 | Architectural in everything ARSA builds |
| Approval timeout behaviour | Fail closed, proposal expires | An unanswered prompt must never become consent |
| Second approver required | Payment, credit, master data and access changes | One person should not be able to move money alone |
| Proposal record retained | 24 months minimum | Covers a full audit cycle plus the prior year’s comparatives |
| Commit record retained | Life of the record in the target system | The log outlives the agent that wrote it |
| Log storage location | Same infrastructure as the deployment | Nothing about a write reaches a third party |
| Approval identity source | Your existing directory and roles | The agent inherits permissions, and grants none |
| Feasibility assessment defining all of the above | $4,500, two weeks | Deducted from the project fee if you contract within 90 days |
One parameter deserves emphasis because it is the common failure. Approval fatigue defeats a gate faster than any technical bypass. Published analysis of MCP deployments through 2026 repeatedly identifies the same pattern: high-frequency prompts, truncated context in the dialog, and several approvals presented at once, after which people approve without reading. The remedy is to reduce the number of writes the agent proposes per task, present one decision at a time with the full payload visible, and keep the per-decision cost of a mistake low enough that reading is worth doing.
REGULATION
What The Rules Require, And When
Two obligations in the EU AI Act bear directly on this, and their timing changed in 2026. Article 12 requires automatic event logging sufficient to reconstruct an individual AI-assisted decision after the fact. Article 14 requires that a system be designed so a person can effectively oversee it while it is in use.
The deadline moved. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force three days later, deferring the high-risk obligations for stand-alone Annex III systems from 2 August 2026 to 2 December 2027, and to 2 August 2028 for AI embedded in products covered by Annex I. The Article 50 transparency obligations kept their original August 2026 date. Most internal ERP and CRM automation is outside Annex III anyway, so the practical value of Articles 12 and 14 for a typical deployment is as a specification that your own auditors, your insurer and your customers’ procurement questionnaires will recognise. Building the log now costs the same as building it in 2027 and answers the questionnaire this quarter.
Indonesian deployments carry a separate constraint. Where the records the agent reads and writes include personal data, the log is personal data too, and it inherits the same residency and retention obligations as the source system. Keeping the log on the same infrastructure as the deployment is the simplest way to avoid creating a second copy in a jurisdiction you did not intend.
BOUNDARIES
What An Approval Gate Does Not Give You
An approval gate prevents an unreviewed write. It does not make the agent correct, and it does not transfer responsibility away from the person who approves.
Four limits are worth stating plainly. A gate does nothing about a proposal that is plausible and wrong, which is why the retrieved evidence sits in the record beside the payload. It does not protect against an approver who trusts the system, which is a training and workload problem before it is a software problem. It cannot reach writes made outside the agent’s path, so an integration that bypasses the connector bypasses the log with it. And the log proves what the system did, without proving the reasoning was sound, because a language model’s stated reasoning is an output of the model like any other. Where a decision carries real consequence, the record exists so a person can check the inputs themselves.
HOW ARSA BUILDS IT
The Pipeline, And Where The Gate Sits
ARSA’s agentic workflows run the same path in every deployment: your corpus, embedding, a local vector store, the model, an approval gate, then the target system. The gate is the last step before anything commits, and it is part of the architecture.
The models are open weight, under permissive licences, selected per workload and running on infrastructure you control. Retrieval, inference and any fine-tuning happen inside your network, so no document reaches an external API at any point in the pipeline. MCP connectors handle ERP, CRM, ticketing and document management, including where the model and the hardware came from somewhere other than ARSA. Every engagement starts with a paid feasibility assessment covering the data model, the integration surface and the permission model, which is the document that settles what the agent may write before anyone writes code. ARSA has been operating AI systems in production since 2018 across defence, law enforcement and industrial deployments, and will tell you when a project is not worth building. The full engagement ladder is on the services overview.
Frequently Asked Questions
What Does Human In The Loop Approval Mean For An AI Agent With Write Access?
It means the agent prepares a transaction and a named person commits it. The agent may read, query and draft freely; the write to your system of record happens only after someone with the authority to make that change has seen the exact payload and approved it, with their identity and the payload recorded together.
Can An Agent Write To Our ERP Without Approval?
No. Every connector ARSA builds is read-only by default and every write is staged for explicit human approval before commit. There is no autonomous write mode to enable, because a switch that exists gets flipped during a busy week.
What Should An AI Agent Audit Log Record?
The proposal, the approval and the commit, as three separate entries. The proposal carries the retrieved evidence and the generated payload, the approval carries the identity, timestamp, decision and any field edits, and the commit carries the target system’s returned identifier, response and diff. Any one of the three on its own leaves a gap an auditor will find.
Does Model Context Protocol Handle Permissions For Us?
No. MCP standardises how a model discovers and calls tools, and its specification places responsibility for consent and denial on the calling application. Permission scope, approval workflow and logging are things you design and your integrator implements.
How Much Does It Cost To Add Approval Gates And Audit Logging?
It is part of the build. ARSA prices the approval gate and the audit trail inside the workflow, because retrofitting a permission model after an agent is in production means re-testing every integration. The $4,500 feasibility assessment establishes the permission model and produces a cost model for the full programme, and the fee is deducted from the project fee if you contract within 90 days.
Who Is Accountable When An Approved Write Turns Out To Be Wrong?
The person who approved it, which is the point of recording who they were and what they saw. The value of the log is that it distinguishes a bad proposal that a person waved through from a correct proposal that a person edited badly, and those two failures need different fixes.
Decide What Your Agent May Commit, Before It Can Commit Anything
If an agent is being scoped against your ERP, CRM or ticketing system, the permission model is the design decision that determines whether it reaches production. ARSA builds private retrieval systems and agentic workflows with an approval gate on every write, deployed on infrastructure you control. Read what the engagement covers on LLM And AI Agent Development, or contact us with the process you want automated and the system it would write to.
Sources: Tools, Model Context Protocol specification, MCP Security Design Guidance, US Department of Defense, June 2026, Article 14, Human Oversight, EU AI Act, EU AI Act Articles 12 and 13, decision traceability, EU AI Act Omnibus Agreement, postponed high-risk deadlines, Gibson Dunn, Digital Omnibus high-risk deadlines after Council approval, Coalition for Secure AI, Model Context Protocol Security