The ERP that acts:
a control tower between the agent and the ledger

In April 2026, Roland Berger published "AI and ERP: A roadmap to harness AI's capabilities and turbocharge your ERP" — circulated under the sharper title "Rivals or best friends?"¹ Its argument is a clean reframe of a debate usually staged as a fight. The ERP does not get replaced by AI; it stays the certified system of record — the auditable, controlled place where the numbers legally live. What changes is the layer on top: the interface becomes a set of intelligent agents, and the ERP shifts from a passive ledger you navigate into, in the authors' words, a "system that acts."

That shift rides on three drivers the article lays out: processes move from manual to autonomous; AI becomes the primary interface to the system, conversational and increasingly headless; and — the one most coverage treats as a footnote — the AI has to be trusted and auditable. Roland Berger is blunt about that third driver: "Automation without accountability is a liability."¹ Every AI action, it insists, must stay transparent, compliant and auditable.

That principle is where this piece picks up. A "system that acts" is exciting right up until you ask the obvious question: acts on what, and who checks it? In an ERP the answer is payments, orders, journal postings and vendor records — and the moment an agent can touch those, the interesting engineering is no longer the agent. It is the gate the agent has to pass through before anything executes. Call it a control tower: AI proposes, a deterministic gate validates, a human approves. That pattern is not Roland Berger's coinage — but as the rest of this piece shows, every serious authority on agentic AI, from Gartner to OWASP to the EU, converges on it.

The evidenceWhy "it can act" is not "it is safe to act"

The uncomfortable base rate is that giving software more autonomy does not, by itself, make it work out. The most-cited number in the agentic-AI debate is Gartner's: it predicts over 40% of agentic-AI projects will be cancelled by the end of 2027, citing "escalating costs, unclear business value, or inadequate risk controls."² Read the three causes again — none of them is "the model wasn't smart enough." All three are properties of the system around the model: cost discipline, value measurement, and risk control. That is exactly the control tower.

The pattern is consistent: the constraint is rarely whether the model can read the purchase order or spot the variance. It is whether the organization can prove the value and control the risk of letting it act. Roland Berger's own framing agrees — which is why the article's load-bearing idea is not the agent, but the gate the agent has to pass through.

The riskAn ERP agent acts on money and identity

This is where ERP raises the stakes far above a chatbot. An "action" in this world is a payment released, a purchase order raised, a vendor master record changed, a journal posted, a credit limit adjusted. When an agent acts here, it acts on money and identity — and the security field has been explicit about what that requires.

OWASP's Top 10 for LLM Applications (2025) ranks prompt injection as LLM01 — the number-one risk, defined as user-supplied input that "alter[s] the LLM's behavior or output in unintended ways," including content that "need not be human-visible/readable, as long as the content is parsed by the model."³ Roland Berger's own headline example is order-to-cash: an agent reads an inbound customer purchase order and drafts the confirmation. But that purchase order is untrusted text from outside your walls — and so is a vendor's contract, a ledger memo, a logistics note. Any of them can be crafted to steer the agent. The lesson is blunt: untrusted input must be treated as data, never as instructions.

OWASP's companion risk, Excessive Agency (LLM06), addresses the other half directly. Its recommended mitigation is unambiguous:

That is the control tower, in the words of the security community — not a flow8 opinion. OWASP has since formalized the agentic case in a dedicated Top 10 for Agentic Applications (December 2025), which carries the principle of least privilege straight into agent design: an agent should hold only the goals, tools and data it needs.⁵ For an ERP, least privilege means the agent gets to propose — and only a human gets to execute. And for regulated operations, that is no longer just good practice. It is law.

The lawThe gate is a legal obligation, not a nicety

An agentic ERP routinely touches high-risk territory — the EU AI Act explicitly lists AI used to evaluate "the creditworthiness of natural persons or establish their credit score" as high-risk⁷ — and two of its requirements land squarely on the control tower:

• Human oversight (Article 14). High-risk systems must be designed so they "can be effectively overseen by natural persons," who can "disregard, override or reverse the output" and "interrupt the system through a 'stop' button" — while the design actively guards against automation bias.⁷ That is the approval gate, written into statute.
• Record-keeping (Article 12). High-risk systems "shall technically allow for the automatic recording of events (logs) over the lifetime of the system" to ensure traceability.⁷ That is the immutable ledger of what was proposed, gated and decided. High-risk obligations apply from August 2026.

The U.S. NIST AI Risk Management Framework reaches the same destination from a different direction: its four core functions are Govern, Map, Measure, Manage, with Govern described as "a cross-cutting function that is infused throughout AI risk management."⁸ Govern first, then build. A human on every high-consequence action and a full audit trail are not features you bolt on after a successful pilot — they are the conditions under which the pilot is allowed to exist at all.

There is a sovereignty dimension too. Cisco's 2025 Data Privacy Benchmark Study found 90% of organizations believe local storage of data is inherently safer, and 64% worry about inadvertently sharing sensitive information with AI systems.⁹ For the data inside an ERP — financials, customer master data, payroll — "where does it run" is not a preference. It decides whether you are permitted to point AI at the core at all.

The synthesisThe control tower is a platform capability

Put the evidence together and a clear conclusion falls out. The exciting part — the agent that reads the PO or reconciles the close — is the easy half. The hard half is the control tower every agent has to pass through: treat every input as untrusted, keep a human on every money-and-identity action, validate against deterministic rules before execution, and log all of it immutably on infrastructure you control. Build that once, as a platform capability, and every new agent inherits it. Rebuild it per-pilot, and you get exactly the graveyard Gartner describes — impressive demos that never reach production because each one re-litigates security, approval and audit from scratch.

That platform stance is the design principle behind flow8. A handful of non-negotiables apply to every automated process it runs — whether drafting an order confirmation or proposing a journal posting:

And it runs self-hosted — on-premise, private cloud or air-gapped — so the data inside your ERP never crosses a boundary you don't own, answering the sovereignty concern Cisco quantifies.

flow8 in practiceOne control tower, four agents that propose

We built Roland Berger's "system that acts" as five concrete flow8 flows. Four are producers — order-to-cash, finance close, procurement risk, supply-chain watch — and each one only ever drafts a recommendation into one shared action ledger (a proposed_actions table). The fifth flow is the control tower: it reads every proposal, runs the deterministic policy gate, and opens exactly one human approval task per action. The architecture, not the prose:

The takeawayBuild the control tower once

Roland Berger is right that AI turns the ERP from a passive ledger into a system that acts, and the shift is genuinely transformative. But the same article is just as clear that automation without accountability is a liability — and every serious authority agrees on the unglamorous half of the story. The organizations that capture the upside will be the ones that treated every input as hostile until proven otherwise, put a deterministic gate in front of every action, kept a human on every money-and-identity decision, and logged all of it on infrastructure they own. Build that control tower once, as a platform capability, and each new agent is a fast, safe addition. Skip it, and you have simply built a faster way to lose control of the systems your business runs on.