Five levels of AI access to an ERP

"The AI reads your ERP" is said by every vendor in this category, and it describes five different things. The gap between the first and the fifth is the difference between a demonstration and a system a finance team can use.

Use this ladder to place any product, including this one.

The five levels

Each level solves a problem the level below it has. Each level also costs more to build, which is why products stop at different rungs.

Level 1: document upload

You export a report, upload the file, and ask questions about it.

This works, and it is more useful than it sounds for a one-off analysis. It has two limits. The data is as old as the export, and the answer covers only what you thought to export.

Every assistant can do this. It is not an ERP integration, and a product that describes it as one is overstating.

Level 2: a nightly copy

Data is copied to a warehouse, a lake or a semantic model, and the assistant reads the copy.

This is the right answer for trend analysis over long periods, and it is where most business intelligence lives for good reasons: the copy is shaped for analysis, it is fast, and heavy queries do not touch the production system.

The limit is time. The copy is as old as the last load. "Which customers are over their credit limit right now?" cannot be answered here, and that is the question a controller asks.

There is a second limit that is easy to miss. The copy has its own permission model, usually coarser than the ERP system's. A person who cannot see a company in Business Central can often see it in the warehouse.

Level 3: a live read through a shared account

The assistant connects with a service account and reads the live system.

Now the data is current, and a real problem appears. The assistant answers with the permissions of the account, not of the person asking. Every user effectively holds the account's permissions.

Two consequences follow. A salesperson can ask a question whose answer includes data they may not see, and the audit record names the service account rather than the person. The first is a data protection problem. The second removes the answer to "who asked for this?".

Vendors reach level 3 quickly because it is easy to build, and it demonstrates well. Ask any vendor whose demonstration is impressive which account the query ran as.

Level 4: a live read as the person asking

Each connection belongs to one user and holds that person's own delegated credentials. The assistant reads through them, so the ERP system enforces the permission.

This is the level where the permission question is genuinely solved, because the limit is not an instruction in a prompt that a clever question could talk around. It is the same check that applies when the person opens the page themselves.

Microsoft's Business Central MCP server is at this level: Microsoft states that all operations are performed with your user identity and permissions, and that audit trails show who performed each action.

Level 5: verified figures and a written record

Level 4 answers "may this person read this?". It does not answer "is the number in the sentence real?".

Level 5 adds three things:

The model writes the query, not the value. The platform runs the query, renders the rows, and tells the model only that a result appeared.

Figures in the prose are checked. Each figure in the written answer is matched against the rows returned in the same turn. Anything ungrounded is removed.

The read reports its own limits. The result carries the record count and whether rows remain, and an aggregate over a truncated read is refused.

Research on financial hallucination describes the failures that this level targets: a figure attributed to the wrong period, a threshold recalled rather than retrieved, a total that is plausible and wrong. These survive every control at level 4.

How to place a product in ten minutes

Four questions, asked in this order.

1. When was this data read? If the answer is a time rather than "now", it is level 1 or 2.
2. Which account ran the query? If it is a service account, it is level 3.
3. How many rows did that query return, and were there more? If the product cannot say, it cannot aggregate reliably.
4. Where did that specific number come from? Point at a figure in the prose, not in a table. If the product cannot trace it to a row, it is level 4.

Most products in this category are at level 3 and describe themselves in the language of level 5.

Which level do you need?

Not everybody needs level 5.

If you analyse trends over years and everybody who asks may see everything, level 2 is correct and cheaper.

If people with different permissions ask questions about current data, you need level 4 or the permission problem is yours.

If a figure leaves the building, in a board pack, a bank covenant or a customer letter, you need level 5. At that point the cost of one confident wrong number is larger than the cost of the whole system.