Pathlock Nexus and the shift to continuous ERP control governance

At a glance

What this is: Pathlock’s article argues that ERP security now needs continuous, transaction-first governance because machine-speed identities can execute financially material actions outside the reach of periodic review.

Why it matters: This matters because IAM, PAM, and NHI programmes must govern not just access rights but transaction context, or they will miss how automation changes control effectiveness in ERP-heavy estates.

Context

Modern ERP control governance assumes transactions can be reviewed after execution and still yield meaningful assurance. That assumption breaks when AI agents, bots, and service accounts can create vendors, approve invoices, run payroll, and release payments at machine speed across interconnected systems.

Pathlock’s argument is not that traditional ERP controls disappear, but that identity, privilege, and business process context now have to be evaluated together in real time. For organisations running SAP, Oracle, Workday, and other line-of-business applications, the governance problem is increasingly about continuous assurance over transaction paths, not just access assignments.

Key questions

Q: How should teams govern ERP transactions that are executed by AI agents and bots?

A: Treat the transaction itself as the control point. Teams should define which ERP actions move financial value, then evaluate identity, privilege, and business context at execution time rather than relying on periodic access review alone. That approach is necessary when non-human identities can complete meaningful workflows faster than manual governance cycles can see them.

Q: Why do periodic ERP control reviews fail in automated environments?

A: They fail because the risk is often created by a sequence of individually valid actions, not by one obviously bad entitlement. Periodic reviews can confirm who had access, but they miss whether a bot or AI agent used that access to complete a risky business process before the review happened.

Q: What are the signs that SoD controls are not keeping up with modern ERP risk?

A: Common signs include approved-looking transactions that still produce fraud exposure, conflicting roles spread across multiple applications, and audit evidence that describes access without showing transaction context. If a workflow can be completed end to end by one identity, the SoD model is likely too static.

Q: What should IAM and GRC teams do when non-human identities can move money in ERP systems?

A: They should assign ownership, lifecycle, and transaction accountability to those identities in the same governance model used for human access. The key question is not whether the identity is human or machine, but whether it can trigger material business change without a control gate that sees the full context.

How it works in practice

Why transaction-first ERP controls change identity governance

Transaction-first governance means the control point moves from after-the-fact review to execution-time evaluation. In ERP systems, a single access grant can enable many downstream actions, so the security question is not only who has access, but what transaction sequence that access can produce. When identities are human, non-human, or AI-assisted, the transaction itself becomes the unit of assurance. That is why static role review and periodic attestation struggle in dynamic environments: they describe authority, but not real-time use. Continuous controls monitoring closes that gap by comparing each action against policy and business context as it happens.

Practical implication: Treat critical ERP transactions as the control boundary and monitor execution-time context, not just entitlements.

How AI agents and service accounts expand ERP risk

AI agents, RPA bots, and service accounts change ERP risk because they can execute approved-looking actions at scale, quickly, and without the human pacing that traditional controls assume. This is not just automation volume. It is a shift in how privilege is consumed: many actions can be legitimate in isolation yet risky in sequence, especially when the same identity can touch procurement, payments, and records management. That creates a control problem across both access governance and business process integrity. NHI governance therefore has to cover ownership, lifecycle, and transaction accountability for machine identities, not just for staff accounts.

Practical implication: Map non-human identities to the transactions they can trigger and verify those paths against business process boundaries.

Why toxic access combinations matter more in multi-ERP estates

Toxic access combinations remain a core ERP risk because a person or machine identity may hold roles that are harmless separately but dangerous together. In multi-ERP environments, that risk grows when role design, approvals, and data movement differ across SAP, Oracle, Workday, and surrounding business applications. Continuous assurance matters here because segregation-of-duties failures are often process failures, not just provisioning failures. If an identity can initiate and complete a financial workflow, the control issue is no longer theoretical. It becomes a live exposure that can drive fraud, audit exceptions, or policy violations before a periodic review ever sees it.

Practical implication: Continuously test segregation-of-duties paths across ERP systems and flag combinations that enable end-to-end financial action.

NHI Mgmt Group analysis

Continuous ERP assurance is now an identity problem, not just a controls problem. The article’s central shift is that access, transaction context, and business risk have become inseparable in modern ERP environments. Periodic review can still describe who should have access, but it cannot explain whether a machine-speed transaction chain was safe in the moment. Practitioners should treat governance as execution-time identity assurance.

Transaction context is the missing control plane in multi-ERP governance. A role or entitlement tells you what an identity can theoretically do, but it does not tell you whether a vendor setup, invoice approval, or payroll action was valid in sequence. That gap matters most where SAP, Oracle, Workday, and adjacent applications interact, because business risk emerges across systems rather than inside one application. The implication is that control design must follow the workflow, not the system boundary.

Non-human identity governance has moved from inventory to accountability. The article describes AI agents, bots, and service accounts as active participants in financial processes, which means the old question of ownership is no longer enough. If a machine identity can perform a material transaction, its lifecycle, scope, and audit trail have to be governed with the same discipline as human access. The named concept here is transaction-first governance: control effectiveness is measured at the point of action, not after the fact.

Static segregation-of-duties models are being outpaced by dynamic execution paths. Traditional SoD checks assume that conflicts can be detected at assignment time or during review cycles. In AI-driven ERP operations, the conflict may only appear when a sequence of valid actions forms a risky business process. That means the governance assumption behind many legacy models no longer holds. Practitioners should re-evaluate where SoD is enforced and whether it reaches the transaction layer.

The market signal is convergence between ERP controls, NHI governance, and assurance analytics. The article places continuous controls monitoring, non-human identity governance, and threat detection into one operational frame. That convergence reflects where the category is heading: control programmes are becoming identity-aware and process-aware at the same time. For practitioners, the question is no longer whether to monitor more, but whether their governance model can interpret actions as they happen across human and non-human actors.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Transaction-first governance: ERP control design is shifting from entitlement review to execution-time assurance, because the relevant risk is the business action itself rather than the role that enables it. That means control owners need evidence at the moment a transaction is authorised, not only after it is recorded.

Continuous assurance becomes the practical response when AI agents, bots, and service accounts can chain legitimate actions into risky financial outcomes. For identity teams, that changes the programme question from who has access to whether the workflow can still be trusted at machine speed.

For practitioners

• Define transaction-level control boundaries Identify the ERP transactions that actually move money, change obligations, or alter financial state, then treat those as the governance boundary for monitoring and approval.
• Map non-human identities to business processes Inventory AI agents, bots, and service accounts by the specific ERP workflows they can execute, including vendor creation, invoice approval, payroll, and payment release.
• Continuously test segregation of duties paths Check whether combinations of roles or machine privileges let one identity complete an end-to-end financial workflow across SAP, Oracle, Workday, or adjacent applications.
• Tie audit evidence to execution-time context Capture the policy decision, transaction attributes, and identity context together so audit and investigation workflows can show why each action was allowed.

Key takeaways

• ERP risk now concentrates in the transaction path, where identity and business context interact in ways periodic review cannot fully see.
• AI agents, bots, and service accounts can complete high-value workflows quickly enough that static governance loses visibility into sequence and intent.
• The control answer is to monitor execution-time context, ownership, and segregation of duties across the workflows that actually move value.

Key terms

• Transaction-first governance: Transaction-first governance evaluates the business action created by an identity, not only the entitlement assigned to it. This matters in hybrid environments because a permission can appear harmless until it is used to create a risky transaction, approve a payment, or alter production state.
• Continuous Controls Monitoring: Continuous controls monitoring is the ongoing evaluation of transactions, access, and configuration changes against policy rules. It replaces occasional sample testing with near-real-time detection, which gives security, audit, and finance teams faster evidence and a better chance to correct drift before it becomes a finding.
• Non-Human Identity Governance: Non-human identity governance is the practice of managing, controlling, and auditing every machine identity across its full lifecycle. It covers service accounts, API keys, tokens, certificates, and AI agent credentials, ensuring each has a defined owner, scoped privilege, rotation schedule, and revocation path. Without governance, NHIs accumulate silently and become the primary attack surface in cloud and automated environments.
• Toxic Access Combination: A toxic access combination is a set of permissions that becomes dangerous when granted together, even if each entitlement looks acceptable on its own. In identity governance, these combinations matter because they can enable misuse, separation-of-duties failures, or broader compromise.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.