Agentic AI within ERP and SaaS systems

What makes it hard

• Autonomous action raises the stakes: these systems act on student records, finance, and human-resources data, which constitutes a higher risk class than a system that only responds to queries.
• The institution does not control the model: the prompts, behavior, and update cadence are determined by the vendor, and default settings may enable the capability.
• The capability operates within systems of record: the agent processes FERPA, financial, and HR data in the authoritative system rather than in a sandbox.
• Procurement has already occurred: the capability operates under an existing master agreement and data-processing agreement that generally did not contemplate autonomous action or model training.
• Ownership is cross-functional: these agents fall under the Registrar, Finance, HR, and service owners rather than a central AI function, which distributes accountability.

How the framework applies

The moves in sequence, each tied to a pillar, the tool to reach for, and what you walk away with.

1. 1
   Pillar 2

   Establish the requirements governing autonomous action

   Before any capability is enabled, establish the principles that govern an agent that acts: a human remains accountable for consequential decisions, affected parties are informed when an agent has acted, and decisions are contestable. These principles form the criteria each agent capability must satisfy.

   Pillar 2 · AI Principles

   ProducesAI Principles applied to autonomous action
2. 2
   Pillar 3

   Classify agent actions by consequence and require proportionate oversight

   Establish a graduated-autonomy policy that classifies each agent action by its stakes and sets the corresponding human-in-the-loop requirement: suggestion only, human approval required, action with logging, or autonomous action for low-consequence reversible tasks. Proportionate oversight is the central principle of the approach.

   Tool Evaluation Matrix

   ProducesAgent-action classificationHuman-in-the-loop / autonomy policy
3. 3
   Pillar 4

   Review the contract under which the capability operates

   Determine whether the existing master agreement and data-processing agreement address the agentic functionality: use of data for model improvement, action logging and audit access, liability in the event of an agent error, and FERPA and GLBA exposure. Most predate this functionality and require an addendum. Document each vendor agent as a system with a model card.

   Governance Question Guide

   ProducesContract / DPA addendum checklistRisk registry entriesSystem and Model Cards per vendor agent
4. 4
   Pillar 5

   Engage the parties whose work and records the agent affects

   Staff whose workflows the agent alters, students with whom it communicates, and, for HR agents, collective-bargaining units each hold a stake. Engagement and change management are necessary controls in this context, serving to prevent an agent from materially altering how a function operates without review.

   Pillar 5 · Engagement

   ProducesStakeholder engagement plan
5. 5
   Pillar 6

   Confirm the capacity to monitor and reverse a vendor agent

   Operating a vendor agent requires access to action logs, a means of reviewing the actions taken, the ability to reverse them, and the competencies to configure guardrails. Where the institution cannot observe or reverse an agent's actions, it is not ready to enable the capability.

   Maturity Assessment

   ProducesReadiness gaps for agent oversight
6. 6
   Pillar 7

   Designate the accountable decision owner rather than defaulting to IT

   This case illustrates the decision layer of responsibility: when an agent acts within the Registrar's, CFO's, or CHRO's domain, that functional owner is accountable for the action, rather than central IT or the vendor. This accountability must be assigned explicitly for each agent; otherwise it defaults to whoever enabled the capability.

   Pillar 7 · Roles & Responsibilities

   ProducesPer-agent accountability mapping (RACI)
7. 7
   Pillar 8

   Enable agents deliberately through inventory, default-off posture, staged enablement, and monitoring

   Operate from a default-off posture: inventory the agents that exist or are forthcoming across each vendor, enable them in stages with a named approver, monitor action logs against the autonomy policy, review on a defined cadence, and maintain an incident and rollback runbook. Vendor release notes are monitored so that capabilities are not enabled without review.

   AI Use Case Registry

   ProducesVendor agent registryStaged enablement and monitoring runbook

Key decisions