This week, two very different ERP vendors shipped the same idea. On October 16, DANAOS Projects released ProjectVIEW ERP v12 with an MCP connector, so assistants like Claude and ChatGPT can work with the system directly. Days earlier, at Rising 2026, Workday said its Trusted Agent Platform is now “headless”, with its own MCP tools for HR and finance.
Headless sounds technical, but the idea is simple. An agent can read data and take actions in the ERP without anyone opening the screens.
I think this is a real shift. But after years of ERP implementations, what I keep coming back to is not the connection. It is the permissions.
What actually changed
MCP, the Model Context Protocol, is an open standard for connecting AI assistants to business systems. Before this, an assistant working with your ERP usually meant a custom integration someone had to maintain.
ProjectVIEW says its connector lets users run operations without opening ERP screens, ask questions about their data in plain language, build dashboards, and create their own agents. Workday’s tools give any MCP-compatible agent an approved way to read data and act, and its Live Data Query lets people and agents query live data in SQL instead of exported copies.
The ERP is no longer only a place people log into. Agents use it too.
The hard part is what the agent is allowed to do
Workday was unusually direct about the risk. It describes two ways this goes wrong. An agent working from an unprotected copy of HR data can see salary details it was never meant to see. An agent connected through a system-level account can act without approval. Its blog calls a custom MCP server on one over-permissioned service account a “god-mode” admin.
I see this pattern in a lot of ERP projects. Integrations often run on one powerful user because it is faster to set up. For a nightly sync, many teams accept that risk. For an agent that can post entries or change records on its own, it is a very different situation.
Workday’s answer is that every request carries the business rules: who is asking, what they can see and do, which approvals apply, and how the action is recorded. Some deeper checks are still coming. Grounded Reasoning, which checks requests against company policy before an agent acts, is expected in early access in early 2027.
Banks are more cautious. Reports on October 17 said Citigroup does not let third-party AI agents log into customer accounts or transact directly, and Bank of America’s CEO said a human should approve before money moves. When there is no governed way in, owners lock the door.
What this means for smaller businesses
Most small and medium-sized businesses I work with do not run Workday. But the same question will reach every ERP, CRM, and inventory system, including custom ones. Before connecting an assistant, I would think through a few things:
- Give the agent its own identity, not a shared admin account. Every action should trace back to the agent and the person who asked.
- Start read-only. Questions and reports are a low-risk place to learn.
- Decide which actions need a person. Posting a journal entry, changing a price, or releasing a purchase order should go through someone, at least at first.
- Keep the log. If you cannot see what the agent did and why, you cannot trust it with more.
- Fix the process first. An agent will follow a messy approval chain just as faithfully as a good one.
If you build custom software, adding an MCP endpoint is not the hard part. Making it respect your roles and approvals is the real work.
Final thoughts
I am curious how this plays out. Opening business systems to agents could remove a lot of manual screen work, especially for small teams and solo operators. But the value will depend on the unexciting parts: roles, approvals, and audit trails.
If you connected an AI assistant to your ERP tomorrow, which actions would you be comfortable letting it take on its own?
Sources
- DANAOS Projects: ProjectVIEW ERP v12 Is Now Available (Oct 16, 2026)
- Workday Newsroom: Trusted Agent Platform Now Delivers Headless Access to HR and Finance (Oct 13, 2026)
- Workday Blog: Introducing Workday’s Trusted Agent Platform
- Enterprise Times: Workday Unveils Autopilot Agents, a Headless Agent Platform and New Decision Tools at Rising 2026 (Oct 16, 2026)