Systems of record

The systems of record layer (R04) holds the official record: bills, patients, assets, work orders, finance, people and documents. It is one of the fourteen layers. Agents get no new powers inside these systems. An agent acts as the person who asked, with that person's permissions. The system's own permission checks and approval steps stay in place. Risky changes wait for a person until the agent has earned more room. The first decision is whether to use the vendor's built-in agent or your own agent through governed tools.

What sits in this layer today

The standards between these systems: the IEC 61968-1 interface model and ISO 55001 asset management in utilities. Health uses national identifiers, SNOMED CT and ICD-10-AM. Energy and mining use ISO 55001, ISO 14224, API MPMS Chapter 20, AMIRA P754 and the JORC Code. Vendor names are examples from industry knowledge (typical, unsourced). The full estates are on the utilities, healthcare and energy pages.

What agents add

There are two ways in. One is the vendor's built-in agent. The other is your own agent, calling the vendor's APIs through governed tools. In 2026, most large vendors made both paths pass through the same permission checks. So the choice turns on model control, price and limits, as the choices below explain.

layer · architecture

Wrap existing systems behind governed tools

Agents act as the requesting user through wrapped governed APIs; entitlement stays in the record system and audit attributes to the human.

1. 01Agent

   Agent

   Embedded agent

   Vendor-hosted, same permission boundary

2. 02Agent

   Agent

   External agent

   Through the gateway, run-as-user

3. 03Control

   Control

   Permission boundary

   CRUD, field-level security, sharing rules

4. 04Control

   Control

   Write gate set by impact

   Native approval machinery; relaxed by demonstrated reliability

5. 05System

   System

   Record

6. 06Evidence

   Evidence

   Audit log

   Attributed to the human identity

Embedded agents do not pause by default; the human checkpoint is wired by you, not the platform.

Diagram description: Two agent paths, embedded and external, converging on the record system's own CRUD, field-level security, and sharing-rule enforcement, with audit attributed to the requesting user. The map contains Embedded agent: Vendor-hosted, same permission boundary; External agent: Through the gateway, run-as-user; Permission boundary: CRUD, field-level security, sharing rules; Write gate set by impact: Native approval machinery; relaxed by demonstrated reliability; Record; Audit log: Attributed to the human identity. Its connections are embedded to perms; external to perms; perms to gate; gate to record; record to audit. Important boundary: Embedded agents do not pause by default; the human checkpoint is wired by you, not the platform.

The agent works through the system's own controls

Wrap existing systems behind governed tools. Do not rebuild their controls. A tool server carries the caller's identity into the API that already enforces permissions, validation and audit. It is not a new policy engine. Finance, customer, HR and service desk systems hold decades of access rules and approval routing. A second copy of those rules, built for agents, would be weaker.

Four rules follow. Tool calls run as the person who asked, never as a shared service account. Field-level security and sharing rules stay in force. Risky changes go through the system's own approval steps. The audit log names the person who asked.

Write access grows with evidence, like trust in a new colleague. At first a person reviews every change. Review relaxes as the record builds. This is the autonomy contract applied to one permission. The autonomy contract is the agreed level of autonomy, and the controls it needs, for one piece of work.

Vendors now give outside agents the same checks

Four of five large vendors now say outside agents get the same permission checks as their own agents.

• Salesforce. Its hosted MCP server became generally available on 14 July 2026. Its own words: "If you can't do it in Salesforce, your agent can't do it through the MCP server" [vendor].
• ServiceNow. Its MCP server became generally available on 5 May 2026. It opens workflows and approval chains to outside agents [vendor].
• Workday. Since 2 June 2026, outside agents inherit its security model, business process controls and audit trail [vendor].
• Oracle. Fusion 26A ships MCP and the agent-to-agent (A2A) protocol [vendor].
• SAP is the exception. Its API policy says that for agent use, A2A through Joule is the only way. It has been enforced since 9 June 2026.

What still differs between the two paths is model control, the price meter, and how far you can customise.

Matching records across systems

Work that spans several systems breaks on matching records, not on finding them. The same customer has a different identifier in each system. An agent querying three systems has no reliable way to know they describe one customer. In electricity, three records must agree: the network map, the asset register and the market's standing data. They often do not, and that gap drives exceptions. In water, the billing, asset and map systems must agree on the property, the meter and the main.

Reporting definitions built for analysts do not solve this. So work across systems runs on an outside orchestrator, which coordinates the steps through the integration fabric (R03). Record matching is a named part of it.

What it costs

Vendors charge for agent activity in four ways, and none of them is a seat. Salesforce charges per action in steps of tokens, so wordy lookups multiply cost [vendor]. SAP sells prepaid pools of AI units [vendor]. ServiceNow charges per "assist", by the size of the action [vendor]. Oracle includes 22 Fusion agents at no extra cost in release 26B [vendor]. Governance tooling is a fifth line. Microsoft charges $15 per user per month for Agent 365 [vendor]. So compare total cost, including governance, before you buy. The list prices are in the research block below.

The parts and where they run

What must be true before an agent touches it

The agent runs as the person who asked. Never as a shared service account. The delegation chain carries that person's identity from the request to the record.

The system's own checks stay on. Field-level security, sharing rules and approval routing apply to the agent as they do to people.

You add the pause. A built-in vendor agent does not stop for approval by default. Salesforce agents act unless a person's approval step is wired in through Flow. Oracle's approval routing can check whether a person or an agent holds authority. Set the approval step by impact, one of the four questions. Impact is what the change can damage, and whether it can be undone. Track the override rate. A falling override rate is the evidence that earns more autonomy.

You run your own tests on every vendor release. Vendors can change the model under an agent without notice. No vendor at this layer publishes a notice period for model changes. None lets you pin the model of its own agents. Where you can bring your own model, you can pin it again. A failing test run blocks the release.

Every agent is registered, with an owner. Each agent has its own identity, a named owner and a lifecycle state. That is the register stage of the agent lifecycle. Workday gives agents their own user accounts and assigned owners, the way workers get managers [vendor].

SAP records take SAP's path. Plan SAP-held records as a separate integration class, with its own route and price exposure.

The enforcement point is the system of record's own permission boundary. Your own agents reach it through the tool gateway, one of the seven capabilities an agent platform provides. Vendor agents reach it directly. Both meet the same checks.

Choices and their verdicts

Each entry is the common choice, tested against the simplest credible alternative. The full records are in the decision catalog. For whole packaged applications, see agents and packaged applications.

• The vendor's built-in agent or your own agent through governed APIs: decide by where the work's authority sits. If it stays inside one system, both paths get the same checks. Choose on model control, price and limits. If it crosses systems, your own orchestration is required.
• SAP's closed path is a constraint, not a choice. Two analyst firms criticised it in May 2026. One advised freezing multiyear third-party AI deals that depend on SAP data.

Concerns this layer must honour

A concern is a requirement every layer must honour. This layer carries a specific duty for eight of the ten.

• Identity and access. Agents act as the person who asked. Permissions stay in the record system. No shared service accounts.
• Traceability and audit. The system's own log names the person. Approval decisions are kept.
• Grounding. Records across systems are matched. Each definition has an owner.
• Impersonation and authenticity. The agent's identity is separate from the person's in the directory.
• Sovereignty and residency. Record residency extends to agent memory, logs and derived indexes. Vendor retention and export terms are buying items.
• Privacy. HR and customer records carry duties to workers and customers. Agent memory inherits them.
• Safety and oversight. Risky writes need approval, set by impact, because built-in agents do not pause by default.
• Cost. Per-action meters charge in token steps. Lookups and actions draw from one pool. Governance is priced separately.

The full grid of concerns against layers is the concern matrix.

Evidence and limits

The vendors' own statements support the main rule: outside agents get the same permission checks as built-in ones. Prices are vendor list prices and they move. Check them before you buy.

The incidents on record are platform security flaws and coding agents deleting databases. No published incident shows a built-in record-system agent corrupting finance or HR records at scale. So patching and safe default settings matter most today.

Three gaps are findings in their own right. No one has published a head-to-head test of a built-in agent against an outside agent on the same task. No one has published a move of a production agent estate between record platforms, so portability claims are untested. No vendor publishes how it manages changes in its agents' behaviour.

Next step

See this layer at work in resolving billing exceptions, where the billing system keeps every decision about money. Then read the next layer, line of business and OT (R05).

Explore this topic

• Systems of record findings and sources.

Vendor paths for outside agents

• Salesforce announced Headless 360 at its TDX event on 15 April 2026 [vendor].
• Salesforce's hosted MCP server became generally available on Enterprise editions and above on 14 July 2026 [vendor].
• Salesforce actions run as the signed-in user, with the same rights, field security and sharing rules [vendor].
• ServiceNow Action Fabric (5 May 2026) put its MCP server in every Now Assist and AI-native edition [vendor].
• ServiceNow names Claude, Copilot and homegrown agents as callers [vendor].
• Workday Agent-Ready Tools and Agent Passport launched on 2 June 2026 [vendor].
• Workday's Agent System of Record became generally available in February 2026 [vendor].
• Oracle ships MCP and A2A in Fusion 26A. Published agents become callable over A2A by release 26C [vendor].
• Salesforce limits: 20 active agents per org, 15 topics per agent, 15 actions per topic, 60-second action timeout.
• Those Salesforce limits are not yet checked against the official limits document.
• SAP API Policy v4/2026, section 2.2.2: "For agentic use cases, A2A via Joule is the only way."
• SAP has enforced that policy since 9 June 2026.

Pausing and autonomy

• ServiceNow markets autonomy, with a person in the loop for security containment [vendor].
• ServiceNow's first-line IT desk agent is generally available, with "91% of cases without reassignment" [vendor].

Prices (vendor list prices)

• A Salesforce standard action is 20 Flex Credits, about $0.10, for up to 10,000 tokens [vendor].
• An action using 20,001 tokens bills 60 credits ($0.30), three steps rather than two [vendor].
• An alternative Salesforce meter runs about $2 per 24-hour conversation [vendor].
• Flex Credits fund lookups, actions and bring-your-own-model calls from one pool [vendor].
• The pool sits above a Data 360 Starter minimum near $60k a year [vendor].
• SAP sells prepaid pools of roughly 200 actions per Advanced full use equivalent [vendor].
• SAP overage runs $0.08 to $0.18 per action [vendor].
• ServiceNow prices a small agent action at 25 assists and a large one at 150 [vendor].
• ServiceNow does not publish pool sizes or overage rates. Its own community guidance flags this.
• Roughly half of ServiceNow's new annual contract value is now not priced per seat.
• Oracle includes 22 Fusion agents at no extra cost in release 26B [vendor].
• Microsoft Agent 365 costs $15 per user per month [vendor]. Another stack includes governance free.
• Deloitte projects 40 percent of enterprise SaaS spend on usage, agent or outcome pricing by 2030.
• Generic benchmarks show up to fiftyfold cost variation per task ($0.10 to $5.00) at similar accuracy.

Adoption

• Salesforce reported Agentforce annual recurring revenue of $800M in Q4 of fiscal 2026 [vendor].
• Salesforce reported $1.2B in Q1 of fiscal 2027 [vendor].
• Paid adoption near 6 percent of an installed base of about 150k is derived, not disclosed.
• An analyst forecast: fewer than 15 percent of firms turn on agent features in their automation suites in 2026.

Incidents

• ForcedLeak scored 9.4 on CVSS and was patched on 8 September 2025.
• ForcedLeak was an indirect prompt injection through Salesforce Web-to-Lead.
• ForcedLeak leaked CRM data to an expired allowlisted domain, bought for about $5.
• ServiceNow BodySnatcher, CVE-2025-12420, scored 9.3 on CVSS and was patched on 30 October 2025.
• BodySnatcher allowed impersonation without logging in.
• The AppOmni second-order injection came through Now Assist agent discovery.
• In that case, agents ran with the initiating user's rights. Three shipped default settings were the root cause.
• Coding agents deleted development databases at Replit (July 2025) and PocketOS (April 2026).
• One major platform deletes agent memory after 28 days of inactivity, with no documented export.

Refusals and checks

• Not relied on: a claim that 3 percent of Joule customers run in production. It has a single, unverified origin.
• Re-verify before buying: meter rates and pool disclosures.
• Re-verify each quarter: SAP's enforcement of its agent policy, and A2A production readiness.