AI agents for Business Central
An agent does not just answer — it acts. Which makes the interesting question not what it can do in principle, but which actions you should actually let it take in your ledger.
Short answer: an AI agent reasons across several steps, calls tools and executes the actions you have explicitly permitted, inside a permission set you assign. It is not an autonomous system with access to your ERP. The realistic pattern in finance is that the agent prepares and proposes, and a person commits.
What makes something an agent
The technical distinction is simple. An assistant receives a question, queries data, returns an answer. An agent runs a loop: it decides which tool to call, sees the result, decides what to do next, and repeats until it reaches a stopping point. Some of those tools write.
That loop is the source of both the value and the risk. Value, because a task like “find every overdue invoice above €10,000, check whether the customer has open orders, and draft a reminder for each” requires several dependent steps that a single query cannot express. Risk, because a loop that can write is a loop that can write repeatedly, and it needs a boundary that does not depend on the model behaving well.
Which actions are worth automating
Not every step that can be automated should be. The useful frame is what a mistake costs and how easily it is noticed.
| Action | Cost of a mistake | Typical control |
|---|---|---|
| Draft a document for review | Wasted minutes | Run unattended |
| Create or update a master record | Bad data, visible later | Unattended with change logging |
| Create a sales or purchase order | Recoverable while unposted | Unattended, review before release |
| Start an approval workflow | Low — a person still approves | Unattended |
| Release or post a document | Reversal, audit trail noise | Person commits |
| Payment or credit decisions | Money leaves, or does not arrive | Person decides, always |
Read the right-hand column as a starting position, not a rule. Where the boundary sits is a decision per process, made during discovery with the people who own that process — a distributor with thousands of low-value orders and a manufacturer with fifty high-value ones will draw it in different places, and both will be right.
How the agent is actually constrained
Three independent layers, and the ordering matters — each one holds even if the one above it fails.
- The tool set. The agent can only call operations that were explicitly built and exposed to it. There is no general write access; there is a list. If “post journal” is not on the list, no prompt produces it.
- The permission set. The identity the agent runs as is a Business Central identity, with a permission set and company scope. Business Central refuses anything outside it, exactly as it would for a person.
- Approval workflows. If your setup requires a purchase above a threshold to be approved, the agent's request enters the same workflow. It does not bypass it, because the platform enforces it and the agent is just another requester.
The point of layering is that the model is never the security boundary. Prompt engineering is not a control. An agent that has been talked into trying something it should not do will be refused by Business Central, and the attempt will be in the log.
Auditability
Agent actions are logged like any other user's. In practice we recommend a dedicated identity per agent rather than a shared service account, so that the change log answers “which agent did this, when, and in response to what” without correlation work. If you cannot tell agent activity from human activity in your audit trail, you will not be able to answer that question during a review — and it is much cheaper to decide this at design time than to retrofit it.
Microsoft's own agents
Microsoft has been adding agent capabilities to Business Central directly, and this area moves quickly enough that the current list is worth checking in Microsoft's documentation rather than in anyone's marketing. Where a Microsoft agent covers your process, use it — it is cheaper and maintained by the vendor. Custom agents make sense for processes specific to your company: your approval rules, your industry's workflow, your terminology, or work that spans Business Central and systems outside it. The overview page compares the two approaches in more detail.
What we do not promise
Unattended autonomy over your ledger. An agent is a well-constrained tool, not a member of staff. It has no judgement about whether an action is a good idea in context, only about whether it fits the pattern it was built for. Anything requiring commercial judgement — whether to extend credit, whether to accept a late delivery, whether this customer is worth keeping — stays with a person, and we design the stopping points explicitly rather than hoping the model declines.
What it costs
Agents start from $6,000 and custom agents built around a specific business process from $10,000, after an AI Discovery from $750. Agents cost more than assistants for one reason: the testing. Verifying that a system refuses what it should refuse takes longer than verifying that it answers what it should answer.
Related
Frequently asked questions
Can an AI agent post documents without a person?
Technically yes, if you grant it that permission. In practice most finance workflows are configured so the agent prepares and proposes while a person posts. Which steps run unattended is decided per process during discovery — it is a policy choice, not a limit of the technology.
What stops an agent doing something it should not?
Three layers. It can only call operations that were explicitly built for it; the identity it runs as has a Business Central permission set that the platform enforces; and approval workflows apply to its requests as they would to anyone's. The model itself is never the security boundary.
How do we tell agent activity from human activity in the audit trail?
By giving each agent its own identity rather than sharing a service account. Then the change log answers who did what without correlation work. This is much cheaper to decide at design time than to retrofit after a review asks the question.
Is this the same as Power Automate?
No, though they overlap and often work together. Power Automate runs a flow you defined in advance: the steps and their order are fixed. An agent decides which steps to take based on what it finds. If your process is genuinely fixed, a flow is cheaper, more predictable and the right answer.
What happens if the agent gets it wrong?
That depends entirely on which actions it can take, which is why the action list is the important design decision. An agent restricted to drafting and proposing produces a bad draft that someone discards. This is the argument for starting narrow and widening once behaviour is understood.
Do agents work on Business Central on-premises?
Usually, but the integration path differs — web services need to be published and reachable, which is an infrastructure decision on your side. We confirm this during discovery before quoting.
Ready to modernize your business?
Leave your details and we'll send the details of a free process audit. We reply within one business day.
or write directly: info@nbcs365.com · +380 98 107 5878