Enterprise AI in CRM and ERP is moving from answering questions about business data toward initiating work in business applications. Two product announcements this week illustrate that shift: Odoo introduced version 20, while Microsoft published a new update on agentic capabilities across Dynamics 365 ERP.

The announcements describe different products and release stages. Taken together, they also bring a practical implementation question into focus: as agents move from retrieving information to changing records or starting transactions, how should organizations define what each agent is authorized to do?

Odoo 20: natural-language instructions for business workflows

Odoo announced version 20 on September 24. Its launch article describes AI agents that can start processes from natural-language instructions. Examples include confirming a sales order after a matching email arrives, assigning a lead to a salesperson, creating a project after a contract is signed, and notifying a user when stock falls below a threshold. Odoo also describes connecting external AI tools to an Odoo database through MCP, with access rights retained. These are capabilities as described by the vendor; deployment scope and availability can depend on the product edition and configuration. Odoo’s Odoo 20 overview · Odoo 20 release notes

This places the agent inside a business process rather than limiting it to a conversational answer. A request can result in a record being created, a lead being routed, or a follow-on workflow being triggered. That expands the design question from how an agent responds to how its actions are scoped and reviewed.

Dynamics 365: MCP and Copilot Cowork, alongside a preview agent

Microsoft’s September 23 update covers Dynamics 365 Finance, Supply Chain Management, Commerce, Human Resources, and Project Operations. It describes the Dynamics 365 ERP MCP server and the ERP plugin for Copilot Cowork as generally available. The same update identifies Procurement Agent impact analysis in Supply Chain Management as a public preview. The announcement is a roadmap snapshot that includes capabilities available now and others planned through March 2027, so the release status is feature-specific. Microsoft’s Dynamics 365 ERP update

Microsoft documents the ERP MCP server as providing data, form, and action tools to compatible agents. It also describes access being filtered by the authenticated user’s security role: available records and actions reflect the user’s permissions, and calls to unauthorized objects are rejected. The current prerequisites include supported finance and operations app versions and an environment type supported by the MCP server. Microsoft’s ERP MCP documentation

Abstract illustration of an agent connecting customer, supply-chain, finance and project systems through a governed bridge.

AI agents can connect workflows across applications, while each system continues to apply its own data model and access rules.

Connection does not settle authority

Model Context Protocol (MCP) provides a common way for compatible clients to connect to tools and business systems. That connection does not, by itself, decide which application is authoritative when records conflict, which actions should require approval, or who owns a resulting transaction.

For example, a customer address might appear in CRM, ERP, and a data platform. An agent that can read all three still needs a rule for which value governs a shipping change. Similarly, permission to prepare a purchase order is not necessarily permission to submit it. Those distinctions belong to the organization’s data ownership, security, and workflow policies.

An industry report published September 24 highlights these questions as agents gain access across enterprise applications. It notes that organizations are generally proceeding cautiously with independent write access and describes human verification, explicit system-of-record rules, audit trails, and the ability to reverse or compensate for consequential changes as practical controls. TechTarget’s report on agent authority

Editorial illustration of an AI agent pausing at an authorization checkpoint before a consequential ERP transaction.

A permission boundary can distinguish routine, permitted actions from transactions that need human approval.

Questions for an ERP agent pilot

Before connecting an agent to a live business workflow, teams can define a small set of operating rules:

  • System of record: Which application owns each important field or business object?
  • Action scope: Which records may the agent read, draft, update, or submit?
  • Approval threshold: Which changes can proceed automatically, and which require a named person to approve them?
  • Traceability: Can the organization identify the agent, the user context, the information used, and the changes made?
  • Recovery: Can a change be undone, or is a compensating transaction required?

These questions apply whether an agent is native to an ERP, connected through MCP, or coordinated from another AI platform. The specific implementation still depends on the product’s release status, supported environment, licensing, identity configuration, and the organization’s own controls.

The shift is from assistant to workflow participant

Odoo 20 and the latest Dynamics 365 ERP update describe different routes toward agents that can work with business processes. The first emphasizes natural-language workflow automation and external MCP connectivity; the second combines a generally available ERP MCP foundation and Copilot Cowork plugin with a Procurement Agent feature still in public preview.

As more agents gain the ability to write records or initiate transactions, evaluation will need to cover more than answer quality. Permission boundaries, data freshness, exception handling, approval paths, and auditability become part of whether an agent is ready for a business process.

Original sources