Systems of record

Target state

In short: The systems that hold the official record stay in charge, and agents work through them rather than around them.

Systems of record keep their authority. AgentsAgent. Software that uses an AI model to work toward a goal on its own: it reads, decides the next step, uses tools, and keeps going until the job is done or a limit stops it. reach them through Model Context Protocol (MCP)MCP (Model Context Protocol). An open standard for connecting agents to tools and data, like a universal plug. An MCP gateway is the governed version of that plug. servers, a standard plug that wraps the application programming interfaces (APIs)API. A defined way for software to talk to other software. Agents reach systems through governed APIs rather than through screens. those systems already publish. Each call runs as the requesting person's identityAgent identity. A registered account for an agent with a named owner, limited permissions, and credentials that expire, so every action can be traced to who asked., never as a shared service account. Writes that carry consequences are paused for approval, using the record system's own approval machinery. The gate relaxes as the agent demonstrates reliability. Work that spans several systems runs on an external orchestratorOrchestration. Coordinating several agents or steps so they work together on one job. Useful for breadth; it does not make any single step smarter., the component that coordinates the steps. Two facts force this. No single vendor's permission controls are authoritative outside its own system. Entity resolutionEntity resolution. Working out that records in different systems refer to the same real customer, asset, or case., working out that records in different systems describe the same customer or asset, is the binding constraint. Every agent embedded in a vendor product has an eval suiteEval (evaluation suite). A set of test tasks with known right answers, written by people who know the work, used to check an agent before and after any change.: a set of test tasks with known right answers that gates the vendor's releases. Each also has a documented answer to what happens when the vendor changes the modelModel. The AI engine that reads and writes text. On its own it has no access to your systems; everything built around it decides what it may do. underneath it. Platform choice follows where the record and its permission model live, not the use-case category.

layer · architecture

Wrap, do not reinvent

Agents act as the requesting user through wrapped governed APIs; entitlement stays in the record system and audit attributes to the human.

1. 01Agent

   Agent

   Embedded agent

   Vendor-hosted, same permission plane

2. 02Agent

   Agent

   External agent

   Through the gateway, run-as-user

3. 03Control

   Control

   Permission plane

   CRUD, field-level security, sharing rules

4. 04Control

   Control

   Consequence-class write gate

   Native approval machinery; relaxed by demonstrated reliability

5. 05System

   System

   Record

6. 06Evidence

   Evidence

   Audit log

   Attributed to the human identity

Embedded agents do not pause by default; the human checkpoint is wired by you, not the platform.

Diagram description: Two agent paths, embedded and external, converging on the record system's own CRUD, field-level security, and sharing-rule enforcement, with audit attributed to the requesting user. The map contains Embedded agent: Vendor-hosted, same permission plane; External agent: Through the gateway, run-as-user; Permission plane: CRUD, field-level security, sharing rules; Consequence-class write gate: Native approval machinery; relaxed by demonstrated reliability; Record; Audit log: Attributed to the human identity. Its connections are embedded to perms; external to perms; perms to gate; gate to record; record to audit. Important boundary: Embedded agents do not pause by default; the human checkpoint is wired by you, not the platform.

Reviewed 2026-08-20·Sources:r04-systems-of-record findings

Mechanisms

Wrap, do not reinvent

In short: The agent's access layer passes the person's identity into the system's existing controls; it does not build new ones.

The MCP layer is a wrapper. It carries the caller's identity into the API that already enforces entitlementEntitlement. A specific permission a person or agent holds in a system, such as the right to approve an invoice. (who holds which permission), validation, and audit. It is not a new policy engine. Enterprise resource planning (ERP), customer relationship management (CRM), human resources information systems (HRIS), and information technology service management (ITSM) carry decades of access control, approval routing, and audit. An agent toolTool. A function an agent can call to do something real: look up a record, send an email, run a query. Tools are where agents touch your systems. layer that reimplements any of it has added a second, weaker copy of a solved problem. Concretely, four rules apply. Run tool calls as the authenticated user rather than a service account. Keep field-level security and sharing rules in force. Gate consequential writes with the record system's own approval machinery. Log to the user, not to the agent. Write access follows a trust progression, not a policy switch. Like a new colleague, the agent is reviewed on everything at first, and the gate relaxes as evidence accumulates. This is the autonomy contract, the guide's staged rules for how much an agent may do alone, applied to a single permission. The evidence for the pattern is that every shipped vendor path below implements exactly it.

The two-path permission plane

In short: Vendors now let outside agents use the same permission controls as their built-in agents, and four of five say so explicitly.

The load-bearing change of the first half of 2026 is that the permission controls became reachable two ways. One way is the vendor's own embedded agent; the other is an external agent calling in. Four of five systems-of-record (SoR) vendors state parity explicitly. Salesforce announced Headless 360 at the TDX event on April 15 2026. Its hosted MCP server became generally available (GA) on Enterprise editions and above on July 14 2026. Its statement: "If you can't do it in Salesforce, your agent can't do it through the MCP server". Actions run as the authenticated user with the same CRUD rights, field-level security, and sharing rules. The audit log attributes them to that user. ServiceNow (Action Fabric, May 5 2026) made its MCP Server GA inside every Now Assist and AI-native product edition (SKU). That opens workflowsWorkflow. A fixed sequence of steps written in code. Cheaper and more predictable than an agent, and preferred whenever the task allows., playbooks, and approval chains to third-party agents, and ServiceNow names Claude, Copilot, and homegrown builds explicitly. Workday (Agent-Ready Tools and Agent Passport, June 2 2026) lets external agents inherit its security and delegation model, business-process controls, and audit trail. Its Agent System of Record, GA in February 2026, gives agents Agent System User accounts and assigned owners, the way workers get managers. Oracle ships MCP and the agent-to-agent (A2A) protocol in Fusion 26A. Published agents become discoverable and callable over A2A by release 26C. This collapses the 2025 assumption that embedded means governed and external means ungoverned. What still differs is model control, the cost meter, and the customization ceiling. Salesforce hard limits: 20 active agents per org, 15 topics per agent, 15 actions per topic, and a 60-second action timeout. These figures are unverified against the official limits document.

The no-pause-by-default trap

In short: An agent built into a vendor product keeps going unless you deliberately add an approval step, so the pause is your job.

An embedded agent does not pause by default. Salesforce agents execute on configuration and context without stopping for approval, unless a human checkpoint is explicitly wired in through Flow. Oracle is the counterpoint. Its approval routing is a first-class primitive: it can confirm whether a user or an agent holds authority for an action and route the request accordingly. ServiceNow markets autonomyAutonomy level (A0 to A5). How much an agent may do without a person in the loop, from manual (A0) to governed lights-out operation (A5). Set per task, not per agent., with the human in the loop reserved for security containment; its first-line (L1) IT desk is GA with "91% of cases without reassignment" [vendor]. The gate is your job, not the platform's. Wire the checkpoint per consequence class and instrument the override rate, because a falling override rate is the evidence that earns autonomy.

The upgrade problem

In short: Vendors can change the AI model under an agent without warning, so run your own tests on every release.

A model name is not a version. Behavior has changed under unchanged model identifiers, and vendors retire model versions on their own schedules. No vendor at this layer publishes a model-change notification service level agreement (SLA). None offers a customer-controlled pin for its first-party agents, meaning a way to fix which model version they run. No vendor-published practice for managing behavior regressions exists either. Where the platform supports bringing your own model (BYO-model), you regain the pin. That is a concrete and non-obvious argument for BYO-model even when the vendor's default model is better today. Either way, keep an eval suite that runs against every vendor release, and treat a failing run as a release blocker.

Entity resolution binds cross-system work

In short: Across several systems, the hard part is knowing which records describe the same customer, not finding them.

GroundingGrounding. Making an agent answer from trusted company sources it can point to, and refusing when the evidence is weak. across systems (making the agent answer from trusted records it can point to) breaks on entity resolution, not retrievalRetrieval. Finding the few relevant pieces of company information for a task and placing them in front of the model.. The same customer is a different identifier in the CRM, the product database, the marketing platform, and the ticketing system. An agent querying three at once has no reliable way to know they describe one entity. Business intelligence (BI) semantic layersSemantic layer. A shared set of business definitions (what counts as revenue, or an active customer) that keeps agents and reports using the same meaning., the shared business definitions built for reporting, do not transfer. They were built for analysts asking aggregate questions, while agents need to resolve entities, follow relationships, and take actions across systems. No vendor's permission controls are authoritative outside its own records, and A2A is not production-grade for cross-vendor negotiation. So cross-system workflows run on an external orchestrator, with entity resolution as a named component, not an assumed capability.

Meter math

In short: Vendors charge for agent activity in four different ways, none of them a seat, so compare total cost, including governance, before buying.

Four meters price the same activity, and none of them is a seat. All figures are [vendor] list pricing. Per action, with a step function: the price rises in steps of tokensToken. The unit AI usage is measured and billed in, roughly three-quarters of a word., the unit AI usage is billed in. A Salesforce standard action is 20 Flex Credits, about $0.10, and covers up to 10,000 tokens. An operation spending 20,001 tokens therefore bills 60 credits ($0.30): three steps rather than two. Verbose grounding silently multiplies cost. An alternative Salesforce meter runs about $2 per 24-hour conversation. Flex Credits fund grounding, acting, and BYO-model calls from one pool, above a Data 360 Starter floor near $60k per year. Per AI unit: SAP sells prepaid pools at roughly 200 actions per Advanced full use equivalent (FUE), with overage at $0.08 to $0.18 per action. Per assist: ServiceNow prices a small agentic action at 25 assists and a large one at 150. Pool sizes and overage rates are not publicly disclosed, a procurement problem its own community guidance flags. Roughly half of ServiceNow's new annual contract value (ACV) is now non-seat. Included: Oracle ships 22 Fusion agents at no extra cost in 26B. The fifth line is governance: the tooling that registers and oversees agents. It is a separate seat in one stack (Microsoft Agent 365, $15 per user per month) and free in another. So a total-cost comparison that prices actions without governance is wrong by a variable amount. Deloitte projects 40 percent of enterprise software-as-a-service (SaaS) spend on usage, agent, or outcome pricing by 2030.

The incident taxonomy, kept separate

In short: The incidents on record are platform security holes and coding agents deleting databases, not agents corrupting financial or HR records.

No published incident shows an embedded system-of-record agent corrupting financial or human resources (HR) records at scale. The incidents that exist are a different class, and this guide does not conflate them. The first class is platform vulnerabilities. ForcedLeak scored 9.4 on the Common Vulnerability Scoring System (CVSS) and was patched on September 8 2025. It was an indirect prompt injectionPrompt injection. An attack where instructions hidden in content the agent reads (an email, a web page, a document) trick it into doing something its user never asked for.: instructions hidden in content the agent reads tricked it into acting. The attack came in through Salesforce Web-to-Lead and leaked CRM data to an expired allowlisted domain bought for about $5. ServiceNow BodySnatcher (Common Vulnerabilities and Exposures identifier CVE-2025-12420, CVSS 9.3, patched October 30 2025) allowed unauthenticated impersonation. The AppOmni second-order injection came through Now Assist agent-to-agent discovery. Agents ran with the privilege of the initiating user, and the root cause was three shipped default settings. A separate class again is coding agents deleting development databases (Replit, July 2025; PocketOS, April 2026). The taxonomy matters. The platform-vulnerability record argues for patch cadence and default hardening. The record-corruption scenario that dominates write-access debates has, so far, no published instance.

Design decisions

• Embedded vendor agents versus external agents through governed APIs (CD-17). This challenged defaultChallenged default. A technology choice most people treat as obvious, re-examined here against the simplest credible alternative on evidence and cost. asks whether to use the vendor's built-in agent or your own agent calling the vendor's APIs. Decide by authority boundary, and know that nobody has measured this. No published head-to-head of an embedded against an external agent on the same CRM or ERP task exists, from vendors, analysts, or practitioners. Generic benchmarksBenchmark. A public test used to compare models or agents. Useful for orientation; scores can be gamed, so they are claims rather than measurements. show up to fiftyfold cost variation ($0.10 to $5.00 per task) at similar accuracy. So the harnessHarness. The engineering shell around the model: what goes into its working memory, which tools it can call, when it must stop, how much it may spend, and how it recovers when something fails., the engineering shell around the model, matters more than the vendor badge. When the workflow's authority boundary sits inside one system, both paths enforce identical permissions: choose on model control, meter, and ceiling. When it crosses systems, external orchestration is a requirement, not a preference.
• The SAP closed path, a named constraint rather than a choice. SAP's API Policy v4/2026, section 2.2.2, forbids autonomous agent API sequences outside SAP pathways. Its wording: "For agentic use cases, A2A via Joule is the only way", enforced since June 9 2026. Two analyst firms criticized the position publicly in May 2026. One advised chief information officers (CIOs) to freeze multiyear third-party AI deals that depend on SAP data and to negotiate 2027 price ceilings. Plan SAP-held records as a distinct integration class with its own path and pricing exposure.

Cross-cutting concerns

Evidence and limits

Incidents above carry CVE, CVSS, and patch dates where published. Meter figures are [vendor] list pricing and move; re-verify before procurement. Adoption context behind CD-17, the decision on embedded versus external agents, is mixed. Salesforce reports Agentforce annual recurring revenue (ARR) of $800M in the fourth quarter of fiscal year 2026 (Q4 FY26) [vendor]. It reports $1.2B in the first quarter of fiscal year 2027 (Q1 FY27) [vendor]. Paid adoption near 6 percent of an installed base around 150k is derived, not disclosed. An analyst forecast has fewer than 15 percent of firms turning on the agentic features in their automation suites in 2026. The claim that 3 percent of Joule customers run in production traces to a single origin, is unverified, and this guide does not rely on it. The Salesforce agent limits await verification against the official limits document. Three absences are findings in their own right. First, no published head-to-head measurement of embedded versus external agents on identical tasks. Second, no published migration of a production agent estate between SoR platforms, so portability claims are untested. Lock-in concentrates in configuration, not data: one major platform auto-deletes agent memoryAgent memory. What an agent keeps between tasks, from the current conversation up to long-term knowledge about customers or assets. The longer it is kept, the more privacy and retention duties it carries. after 28 days of inactivity with no documented export path. Third, no vendor-published practice for managing behavior regressions in embedded agents. The wrap-do-not-reinvent spine and the write-access trust progression are the authors' position, strongly supported by the vendor parity statements. Re-verify quarterly: meter rates and pool disclosures, SAP enforcement posture, A2A production readiness.

The research behind this page

• Systems of record findings
• Research brief
• Vendor landscape
• Sources