What is agentic ERP?

The definition, and the one word that matters

Enterprise resource planning software has spent forty years getting better at one thing: showing a person the right screen to fill in. The data model is good. The problem is the entering. A team running a conventional ERP spends a surprising share of its week feeding the system rather than running the business, and most of that feeding is routine: raise this, chase that, move this record, attach that document.

Agentic ERP starts from the other end. The word that matters is operate. The software is built so that an AI agent can operate it, which means three things have to be true at the same time.

• Every action is a tool. Anything a person can do in the system, an agent can do through a defined, typed action with a name, inputs and a result. Not a screen-scraper, not a macro, a real interface designed for a machine caller.
• Every call is permissioned. The agent acts with the authority of the person it represents and never more. If you cannot approve a purchase order, neither can your agent. Access fails closed.
• The agent can be yours. The system speaks an open protocol, so the agent you already use (Claude, ChatGPT, a coding agent, an internal one) connects from outside the vendor's box. You are not limited to a chat window the vendor built.

When those three hold, the screens become optional. They are still there, and people still use them to look, review and decide. They stop being the only place work can happen.

Why the term exists now

Two things had to arrive together. The models had to be good enough to reason about a real business task, choose the right sequence of steps and recover when something is missing. And there had to be a standard way to hand a model a set of tools it can call safely. The first arrived with the current generation of frontier models. The second arrived with the Model Context Protocol (MCP), an open specification for connecting AI applications to tools and data, first published by Anthropic in late 2024 and now supported by the major agent clients.

Before MCP, giving an agent access to a business system meant custom integration work for every pairing of agent and application. After it, a business system can publish its tools once, and any compatible agent can discover and use them. That is the practical condition that makes a whole category of software possible, and it is why you are seeing the phrase agentic ERP, and its cousins AI-native ERP and agent-native ERP, at the same time.

How it differs from an ERP with AI added on

Most established vendors have added an assistant to their product. It can answer questions about the data, draft an email, summarise a record, and sometimes fill part of a form. This is useful, and it is not the same thing. The assistant helps a person drive. The person is still at the screen, still the one who clicks Save, still the only party allowed to complete the task.

The simplest test tells the two apart. Take the agent you already use, connect it from outside the vendor's product, and ask it to complete one routine task end to end: invoice a customer for last month's work, send it, and schedule a reminder if it is unpaid in two weeks. If that works within your permissions, with nobody at the screen, you are looking at an agentic system. If the AI only works inside the vendor's chat, and only for the handful of features the vendor chose, it is an assistant on top of the old model.

What it looks like day to day

You stop opening the software to do routine work. You tell your agent what you need, in plain language, and it acts across the whole workspace: the inbox, the customer records, invoicing, stock, the calendar. It asks for a decision only when something genuinely needs you. Here is the shape of one request, as it runs in Sois.

Notice what the person did not do. They did not open the customer, find the project, create the invoice, export it, attach it to an email, send it, and create a reminder. They described the result. The record of all of it exists in the system afterwards, exactly as if they had.

The part people worry about: permissions and control

The objection to letting software act on its own is a good one. An agent with the run of your business has to be contained. In an agentic system the containment is structural rather than a matter of trust in the model.

• Identity. The agent connects as a specific person, through a normal sign-in, and every action is attributed to that person.
• Scope. The tools offered to the agent are filtered by that person's role before the agent ever sees them, and checked again when each one runs.
• Budget. Where the system's own AI does work on your behalf, spend is capped per integration and visible per action.
• Audit. Every call is logged with its inputs and result, so what an agent did is reviewable in the same way as what a person did.

How to get started without a migration project

You do not need to replace what you have on day one. The pattern that works is to launch a workspace, bring in the part of the operation that hurts most (for many small businesses that is invoicing and chasing, for others it is the inbox or stock), connect the agent you already use, and let it run that corner while everything else stays where it is. Expand once you trust it.

1. Launch a workspaceFree to start. Bring in one part of the operation.
2. Connect your agentPaste the workspace address into Claude, ChatGPT or any MCP client and sign in once.
3. Hand it one jobSomething routine and reviewable, such as month-end invoicing.
4. Review, then widenRead the log, correct what needs correcting, add the next job.

Pricing follows the same logic as the architecture. A workspace plan covers the platform; usage scales with what it stores and does; and when the system's own agent does the reasoning, that runs on credit you top up. When your own agent does the reasoning, the platform performs no AI on your behalf and charges nothing for it.

Questions people ask

This article is reviewed when the products it describes change. Next scheduled review: December 4, 2026.