Adding AI agents to your ERP for quotes and orders

The hard part happens before the ERP

Nobody has a reliable number for how much of this work arrives by email. The figures in circulation come from vendors or from slides with no method behind them, and the US Census Bureau counts email as e-commerce, so its digital share includes the very orders we are talking about.

Company disclosures are a better signal. Ingram Micro says self-service reached nearly 70 percent of orders last quarter, and its email-to-order volume still grew 33 percent. Count your own inbox before you trust anyone’s average.

What makes these orders hard is the distance between what the customer wrote and what your ERP knows. Microsoft’s test suite for its own order agent is the best public list of the hard cases: blocked customers, credit limits, unknown items, boxes versus pieces, substitutes, new ship-to addresses and promises nobody authorized. Here is Maria’s request, line by line:

The model reads, and your rules decide

The instinct is to ask how accurate the AI is. For purchase orders there is no good public answer, because we could find no public benchmark that scores them. The closest one, published in August by a vendor, tested 370 mixed documents, and its leading systems scored between 87 and 96 percent at the field level.

Field scores also flatter the result. At 99 percent per field, an order with 100 fields comes through fully correct only 37 percent of the time if errors are independent. Real errors cluster, so the true figure is usually better, but a strong score still does not mean a clean order. Models can also fail quietly. A May study of receipts found them occasionally altering a line-item price or inventing a tax line so that the totals added up.

So give the model a narrow job. It fills a fixed form from the email, and ordinary software takes it from there. Part matching runs from the customer’s cross-reference to an exact identifier to a search limited to what that customer can buy, and each correction is saved so the next order skips the guesswork.

Prices come from the ERP: Microsoft’s agent is designed not to provide or update pricing by email. Credit holds, duplicate PO numbers and pack sizes are rules, and they should stay rules.

This is a practical choice as much as a cautious one. In Thinkingbox, a benchmark of 507 business workflows updated in October, Claude Opus 5 passed 66.5 percent of tasks on one attempt and 47.5 percent when it had to pass all 20. Its authors note that “many failed trials end cleanly.” Short, fixed steps with an ERP checking the result are the design those numbers favor.

Every exception goes to the person who owns it

A model’s own confidence cannot do this routing. In a September paper from researchers at the bank OCBC, native confidence signals could clear only 0.1 to 7 percent of fields at a 10 percent error budget, on invoices and forms. A calibrated score built from legibility, layout, rule checks and a second model cleared 49 to 72 percent.

So we would route on consequence: what this could cost, whether it can be undone, and whether it breaks a policy.

For Maria, that means three people make three separate decisions, and each sees only what they need. The rep gets the split shipment and the date. The sales manager gets the price. The credit team gets the limit. Here is what lands in front of them:

Keep it a quote for as long as you can. Microsoft’s agent always creates a quote first, even when the customer asks for an order, because quotes do not touch planning, reservations or cash forecasts. It calls them “a safe intermediate document.” It does not post, and a person reviews every outgoing message. Oracle’s email agent converts purchase orders “without user intervention.” These are different bets, and you should know which one you are making.

The agent earns write access one step at a time

Think of access as layers. The agent starts on the outside and moves inward only when the evidence says it should:

Give the agent its own user, with its ID on every record it touches and the narrowest permissions that work. The UK’s National Cyber Security Centre advises lowering a model’s privileges to match the least trusted party whose content it reads. For an order agent, that is anyone who can send you an email.

The concern is real. This year, researchers used instructions hidden in ordinary form fields to make Microsoft Copilot Studio and Salesforce Agentforce agents email customer records out. Both vendors have addressed those cases, and we found no confirmed hijack of an order or quoting agent.

The NCSC says these attacks “may never be totally mitigated,” so design as if one will land. The model fills a form, it cannot send free-form email, and changes to a ship-to address or bank details always go to a person.

The quieter risk is the duplicate order. In a September preprint covering nine models in simulated services, when a write got no acknowledgment and reading back could not reveal the outcome, frontier models duplicated it in 56 to 74 percent of episodes. Agents reported success in 90 percent of the episodes where they had duplicated.

Attaching an idempotency key, a unique ID that lets the receiving system recognize a repeat, cut duplicates from 28 percent to 4 percent. Build that check, and test that two legitimately identical orders still go through.

Your ERP vendor’s rules decide how the agent connects

Most guides skip this, and it can decide the project. Since April, SAP’s API Policy has prohibited API use by AI systems that “plan, select, or execute sequences of API calls,” except through SAP-endorsed routes.

Headlines said SAP had banned outside agents. It has not: its FAQ names the Integration Suite MCP Gateway as a route for external AI platforms. MCP, the Model Context Protocol, is the common standard for connecting agents to software. But that FAQ also says it forms no part of any contract.

Oracle’s service descriptions carry a similar clause for Fusion, and expressly allow partner-built agents on authorized routes. Licensing is a separate question. SAP’s on-premise use rights name bots, meter documents created, and define a sales document to include lines “sold or quoted,” so ask how draft quotes count. Have your vendor confirm the design in writing.

Check what your vendor already ships, too. If you run Business Central and your orders are short, its own agent may be all you need. Here is where each one stands today:

Older systems call for a ladder. Practitioners try an API first, then an import file or staging table, and drive the screen last. Screen driving is the riskiest route to write through.

In ERPBench, a September study by Accenture researchers, some screenshot-only agents saved in up to 85 percent of runs and wrote the correct value in as few as 3 percent, while Claude Sonnet 4.6 scored 94 to 100 percent. That was one modern web ERP, and we found no independent data for green screens. If you go this way, read every saved value back.

Start in shadow, on your own order history

Your ERP already holds the answer key. Pair a few hundred recent emails with the orders your reps entered and score the agent against them. Score whole orders, include the ones that caused credit memos, and grade what ended up in the system, not what the agent says it did. Then move through three stages:

This sequence is our judgment. Everyone recommends shadow mode, and we could not find anyone who has published a measurement of it. Microsoft documents the closest pattern for a first segment: one agent for a shared inbox with every review on, another for trusted customers.

Read published results the same way. Nearly all come from vendors, and “touchless” has no shared definition. Fastenal’s CEO described sourcing and quoting falling from “maybe 5, 6 days” to 15 minutes, then added, “That’s just one example.”

Rockwell’s CEO gave the better reason to care: “if we can quote these things more efficiently, then we’ll win more of them.” So start measuring win rates now. In one October survey of distributors, 34 percent did not measure them on new-business quotes.

The order desk changes as well. One vendor case study reports 7 of 30 roles cut and the remaining staff moved toward quality control. We found no independent study of what usually happens. Tell your team what you expect before the pilot, and let reps help set what counts as an exception.

Where these projects stall

They stall on the long tail. A pilot scoped to clean, popular items looks great until it meets the rest of your catalog, so test a full category, odd parts included. They stall on price disputes, when customer POs disagree with your discount logic and every disagreement becomes an exception.

And they stall on recovery. In UndoBench, tested agents completed 83.5 percent of work normally and recovered from a mid-run fault only 46.7 percent of the time. Plan who cleans up a half-finished order before the agent writes its first one.

How Maria’s order ends

An hour later, Maria replies: “Make it 140.” Only what depends on quantity reopens: stock, freight, the date and the credit check. Her part match stands. The agent updates the draft, the rep and the credit team see the change, and the order goes through with each approval attached. Your ERP records the order, who approved each decision, and what the agent saw.

The agent did the reading and the matching. People made the calls that carried risk. The ERP did what it has always done.

Lunon builds these agents on the systems you already run, with our engineers working inside your company from the first workshop through full rollout. If you are still comparing partners, start with our guide to AI transformation companies. If you already know which queue you would hand over first, let’s talk.

Frequently asked questions

Do I need to replace my ERP to use AI agents?

No. The ERP stays the system of record, and the agent works in front of it, reading requests and drafting transactions. Replacement is a separate decision, though vendor deadlines such as NetSuite’s SOAP retirement may affect how you connect.

Can an outside AI agent connect to SAP?

Yes, through SAP’s endorsed routes. Its API Policy restricts AI systems that plan or execute API calls, and its FAQ names the Integration Suite MCP Gateway for external platforms. The FAQ is not contractual, so get your design confirmed by SAP.

How accurate is AI at reading purchase orders?

We found no public benchmark for purchase orders. Published scores are mostly field-level, which overstates how many whole orders come through clean. Test on your own order history, including the orders that caused problems.

Should an AI agent post orders without review?

Not at first. Start in shadow, then have a person approve every draft, then allow posting for named customers on short orders within limits. New customers, new ship-to addresses and price changes should stay with a person.

Do we need clean data first?

Not all of it. You need accurate item, price and customer records for the category you start with. Saved corrections improve matching over time. Test with the odd parts included, because clean-data pilots tend to break on the long tail.

Maria and her order are invented, and nothing here comes from a client. Sources were checked on 6 November 2026. Several are preprints, vendor documents or vendor case studies, and we have said so where it matters. Vendor terms change, and none of this is legal advice.