Every mountain in the world runs on the same unglamorous kit: ropes, gates, signage, patrol and a radio channel that works. Nobody photographs any of it. Everybody depends on it. A production AI architecture has its own version of that kit list — authentication, authorisation, data access, business logic, APIs, integration patterns, auditability, monitoring, human approval, error handling, model behaviour and data governance — and it is the reason the fun parts of the mountain stay open.
What it must not be is “we gave the AI a username and told it to figure things out.” That is ducking the rope at dusk without telling anybody which way you went. That is how incident reports are born.
Layer up before you drop in
Nobody skis in one giant fused garment. You layer, because each layer does exactly one job and any single one of them can come off without the rest of the day ending. Architecture works the same way: separate the responsibilities so each layer can be reasoned about, tested and — the one everybody forgets — revoked on its own.
| Layer | Owns |
|---|---|
| Business Central | ERP records, business rules, financial transactions, posting, core logic |
| Integration layer | Authentication, transformation, routing, APIs, event handling |
| AI layer | Interpretation, classification, summarisation, reasoning, agent behaviour |
| Governance layer | Approval, permissions, oversight, audit, exception handling |
That separation is the entire reason the system stays controllable. Collapse the layers into one and you have stitched your shell to your base layer: nothing comes off, nothing gets adjusted on the hill, and when somebody asks what happened your best answer is “it did that.”
The lifts are already built
Good news before anyone starts welding towers together: you do not need to build every component. Business Central integrates with Power Platform through its connector, and Microsoft’s enhanced MCP server reached general availability in April 2026 for agent connections. The infrastructure exists. Your job is deciding what runs where.
Nobody is impressed that you can get up the mountain. The real question is which integration mechanism belongs where.
Power Automate
The cat track. Not thrilling, gets everybody where they are going, connects things that would otherwise involve a long walk. Good for workflow orchestration: a Business Central event triggers a flow, the flow calls AI processing, a person approves, the result writes back.
Business Central APIs
Good when an application or AI service needs structured data. Pack for the run you are actually doing: an inventory analysis needs item, location, quantity, sales history, vendor and reorder point — not the entire ERP strapped to its back.
Scoping data access to the task is a far better security model, and it makes the system cheaper to run. Nobody has ever skied well carrying somebody else’s luggage.
Marked gates, not a gap in the fence
Out-of-bounds gates are specific, signed and in known places, and everything either side of them is fence. That is not bureaucracy, that is the only reason patrol can find you. The agent model works best on the same principle: capabilities narrow and named. Rather than granting unrestricted access, expose defined operations:
GetCustomerBalanceGetOpenOrdersGetInventoryAvailabilityCreateSalesOrderDraftRequestApproval
Safer, easier to audit, and vastly easier to explain to whoever eventually asks why the AI did that. “It went through gate four at 09:14” is a much better sentence than “it was loose on the mountain somewhere.”
Reading the line is not sending it
You can stand at the top of a chute and study it all morning at precisely zero risk. The moment you drop in, the arithmetic changes completely. The architecture has to draw that same line between reading and changing, because the two risks are not in the same league.
| Capability | Can | Risk |
|---|---|---|
| Read-only | Analyse, summarise, search, recommend | Relatively low |
| Write-enabled | Create and modify records, trigger workflows | Significantly higher |
| Financially significant | Post transactions, release orders, approve payments | Requires the strongest controls |
Patrol does not get disbanded in a good year
Human-in-the-loop is not scaffolding you tear down once the AI has earned its stripes. Ski patrol does not get stood down because the snow has been stable for a fortnight. For a great many business processes the human is a permanent feature of the design, not a phase of it.
Take purchase orders. AI can spot the inventory need, identify the preferred vendor, review pricing, create a draft, explain its reasoning — and then stop at the gate and ask a buyer to approve.
The buyer is still the one who is accountable. The AI just did the bootpack. That is a far more realistic path to ERP automation than granting full autonomy on day one and calling it a strategy.
It has never been to your mountain
A general model turns up like a genuinely strong skier who has never seen this resort: excellent technique, no idea where anything is. It does not know your pricing rules, vendor preferences, customer classifications, inventory policies, approval thresholds, contract terms or industry vocabulary.
Somebody has to hand it the trail map. That context has to be supplied deliberately, through the integration layer, from Business Central, CRM, SharePoint, a data warehouse, documentation or knowledge bases. In effect the architecture turns your enterprise systems into tools the AI is permitted to use.
Know before you go
Nobody sensible drops into the sidecountry without reading the conditions report first, and the people who do are the reason the report exists. Same discipline here. Before you connect anything, answer these:
- Who is the AI acting for?
- What data can it see?
- What actions can it perform?
- What happens when it makes a mistake?
- How are its actions logged?
- Can permissions be revoked quickly?
- Can a user find out why an action was taken?
None of this is new. Every production enterprise integration has been answering these questions for years. AI does not get a lift ticket that skips the queue.
Leave tracks somebody can follow
Fresh tracks are wonderful right up to the moment somebody has to work out where you went. Every AI action should leave enough of a track to reconstruct the whole run afterwards: what it received, what it decided, which tools it called, what data it touched, what it did, who approved, and what happened next.
This stops being a nice-to-have the second AI can write back into Business Central. Before that you are reading the terrain. After that you are standing on it.
The whole mountain on one map
Take one lap first
Do not open the entire mountain on opening day. A general-purpose ERP agent is nobody’s first run. Begin with one process — say, identifying customers with overdue balances and preparing a prioritised collection list.
- Define the data.
- Define the decision.
- Build read-only access.
- Test the recommendations.
- Measure accuracy.
- Add human approval.
- Add controlled write access if it is warranted.
- Monitor it.
Once that works, take another lap. Other candidates stop looking like a cliff once you have ridden the first one top to bottom.
The question has changed underneath you
“Chat with your ERP” is the magic carpet, not the summit. The far more interesting model is that your ERP becomes a set of tools intelligent agents can use to carry out business processes.
Which quietly changes the question from does our ERP have AI? to is our ERP architecture ready for AI? Harder question. Better one.
