Integrating agentic AI with ERP, CRM and core systems without rebuilding them

Dec 25

AI is moving out of slide decks and into the systems organisations already run. That transition is defined less by new models than by something harder: connecting AI to the ERP, CRM, document stores, email and spreadsheets where the work happens.

Integration is where many initiatives stall. Not because models fail, but because systems resist change. A system that cannot read the latest price list, check stock, see a customer's history or record what it did is a demonstration, not an operational tool.

Systems of record stay the source of truth

Gartner's pace-layered application strategy offers a useful map. It sorts an organisation's systems into three layers. Systems of record, such as ERP, finance and core CRM, change slowly and hold the authoritative data. Systems of differentiation support the processes that make an organisation distinctive. Systems of innovation are where new ideas are tried quickly.

Agentic AI belongs above the systems of record, not in place of them. The ERP remains the source of truth for prices, stock and orders. The CRM remains the record of customers and deals. The agentic layer reads from them, does the work and writes back the result, through the same controls everyone else uses. Organisations do not need to replace core systems to benefit from AI. They need AI that respects them.

Read, propose, write

The most important design decision in any integration is what the AI system may do in each connected system. Three levels help:

Read: the system can consult data, such as prices, stock, customer history or certificates, to do its work.
Propose: the system prepares a change, such as a draft order, an updated record or a filing, for a person to approve.
Write: the system makes the change directly, within agreed limits.

Most deployments start with read and propose everywhere, and allow direct writes only for low-risk, well-tested actions. As reliability evidence builds, more actions can move from propose to write. Binding commitments, such as prices, contracts and filings, stay with people.

Least privilege, at every connection

Security engineering's principle of least privilege applies directly: each part of a system should have only the access it needs, and no more. For agentic AI, that means each unit gets credentials scoped to its task, read-only where possible, with every action recorded. A quoting unit needs the price list and the customer record; it does not need payroll. A compliance unit needs the certificate store; it does not need the order book.

This limits the damage any error can do and makes audits simpler. If something goes wrong, the record shows exactly which unit did what, where and when.

Integration patterns are well understood

Enterprise integration is not new. Hohpe and Woolf's Enterprise Integration Patterns, published in 2003, catalogued the reliable ways systems exchange information: messaging, routing, transformation and error handling. Agentic AI uses the same patterns. What is new is that the system on the other end can understand unstructured inputs and decide what to do within limits.

Open standards are making connections easier. The Model Context Protocol, introduced in November 2024 and since adopted widely across the industry, gives AI systems a common way to connect to tools and data sources. Standard connections reduce the custom work each integration needs, and make it easier to change models without rebuilding connections.

Coordination matters more than any single capability

Most organisations will meet three broad forms of AI. One assists with creation: drafting, summarising and analysing. Another anticipates: forecasting demand, spotting risks and surfacing patterns. A third acts: carrying out multi-step work within defined limits.

Each has value. The real change comes when they are coordinated rather than deployed in isolation. A system that reads an enquiry, checks stock and history, prepares a quote, flags an unusual margin and records the outcome is one workflow, not five tools. Agentic design distributes that work across specialised components, each with a defined role and clear handovers, so the whole is explainable, controllable and able to escalate when something falls outside its limits.

Where integrations go wrong

Shadow integrations: quick connections built during a pilot, with broad access and no monitoring, that quietly become permanent.
Copies that drift: data copied out of the system of record and not kept current, so the AI works from stale information.
Unclear ownership: nobody owns the connection, so when a source system changes, the integration breaks silently.
Writes without approval: direct changes to core systems before reliability has been shown.

Each is avoidable with the same disciplines that govern any enterprise system: ownership, least privilege, monitoring and change control.

Questions to settle for every integration

Which systems are the source of truth for each piece of data the AI needs?
For each system, may the AI read, propose or write?
What credentials does each unit hold, and are they the minimum needed?
How is every action recorded, and who reviews the record?
Who owns the connection when a source system changes?

How Mitochondria's agentic AI systems integrate

The approach. Each unit works with the systems an organisation already runs, through APIs, reading from systems of record and writing back through their normal controls. Access is scoped to each unit's task, and data is processed transiently rather than copied out and stored.

What it enables. Quotes from live prices and stock, compliance evidence from the real certificate store, client answers from current records, all without replacing core systems. Every action is recorded, and binding changes go to a person for approval.

The impact. AI that becomes part of how the organisation runs, without rebuilding what already works, and with a clear record of everything it does.