Topic starter
02/06/2026 8:50 pm
TL;DR: ERP governance now has to move from periodic checks to continuous, transaction-first assurance because AI agents, bots, and service accounts execute critical business actions across SAP, Oracle, Workday, and 150+ applications at machine speed, according to Pathlock. Static control models no longer match how identity, privilege, and transaction context interact in modern ERP environments, and the governance gap is in the transaction path, not the audit report.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “Pathlock Reinforces Its Leadership in ERP Security and Controls for the AI Era”.
Key questions
Q: How should teams govern ERP transactions that are executed by AI agents and bots?
A: Treat the transaction itself as the control point.
Q: Why do periodic ERP control reviews fail in automated environments?
A: They fail because the risk is often created by a sequence of individually valid actions, not by one obviously bad entitlement.
Q: What are the signs that SoD controls are not keeping up with modern ERP risk?
A: Common signs include approved-looking transactions that still produce fraud exposure, conflicting roles spread across multiple applications, and audit evidence that describes access without showing transaction context.
Practitioner guidance
- Define transaction-level control boundaries Identify the ERP transactions that actually move money, change obligations, or alter financial state, then treat those as the governance boundary for monitoring and approval.
- Map non-human identities to business processes Inventory AI agents, bots, and service accounts by the specific ERP workflows they can execute, including vendor creation, invoice approval, payroll, and payment release.
- Continuously test segregation of duties paths Check whether combinations of roles or machine privileges let one identity complete an end-to-end financial workflow across SAP, Oracle, Workday, or adjacent applications.
Bottom line: ERP risk now concentrates in the transaction path, where identity and business context interact in ways periodic review cannot fully see.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 8:52 pm
Continuous ERP assurance is now an identity problem, not just a controls problem. The article’s central shift is that access, transaction context, and business risk have become inseparable in modern ERP environments. Periodic review can still describe who should have access, but it cannot explain whether a machine-speed transaction chain was safe in the moment. Practitioners should treat governance as execution-time identity assurance.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM and GRC teams do when non-human identities can move money in ERP systems?
A: They should assign ownership, lifecycle, and transaction accountability to those identities in the same governance model used for human access. The key question is not whether the identity is human or machine, but whether it can trigger material business change without a control gate that sees the full context.
👉 Read our full editorial: Pathlock Nexus and the shift to continuous ERP control governance