# Systems of record
Agents act inside billing, asset, finance and clinical record systems as the person who asked, through the permission checks those systems already run, with risky changes paused for approval.
Author: Murali Sid (https://linkedin.com/in/muralisid)
Source: https://www.agenticarchitectureskills.com/layers/r04-systems-of-record
Published: 2026-08-20
Updated: 2026-10-15
Licence: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/
Cite as: Murali Sid. Systems of record. Agentic Architecture Skills. https://www.agenticarchitectureskills.com/layers/r04-systems-of-record
---
The systems of record layer (R04) holds the official record: bills, patients, assets, work orders, finance, people and documents. It is one of the [fourteen layers](/layers). Agents get no new powers inside these systems. An agent acts as the person who asked, with that person's permissions. The system's own permission checks and approval steps stay in place. Risky changes wait for a person until the agent has earned more room. The first decision is whether to use the vendor's built-in agent or your own agent through governed tools.
## What sits in this layer today [#what-sits-in-this-layer-today]
| System category | Electricity distributor | Water utility | Hospital network | Generator, oil and gas, or miner |
| ----------------------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------- |
| Customer, patient or trading record | Network billing to retailers (SAP IS-U or S/4HANA Utilities, Oracle CC\&B, or in-house) | Customer information and billing system (SAP IS-U or S/4HANA Utilities, Hansen, Oracle CC\&B, TechnologyOne) | Electronic medical record (Epic, Oracle Health, InterSystems TrakCare, Altera, Dedalus, Meditech). Patient administration system (DXC iPM, webPAS, TrakCare) | Energy trading and risk management (ION Openlink Endur, Allegro, in-house). Joint venture accounting |
| Measurement record | Meter data management, where it owns meters (Itron IEE, Oracle MDM, Siemens EnergyIP) | Lab system (LabWare, Thermo SampleManager) | Pathology lab system (Cerner PathNet, Epic Beaker, AUSLAB). Radiology RIS and PACS (Sectra, Agfa, Philips) | Production accounting and allocation (Quorum Energy Components, SLB Avocet, Peloton). Metal accounting for miners (ION Algosys, Caspeo) |
| Asset and work management | SAP PM or EAM, IBM Maximo, Oracle WAM | IBM Maximo, SAP PM | Biomedical engineering maintenance system | SAP PM, IBM Maximo, Hitachi Energy Ellipse, HxGN EAM |
| Network or spatial record (GIS) | Esri ArcGIS Utility Network, GE Smallworld | Esri | None listed | Esri. Tenement register for miners (Trimble Landfolio) |
| ERP, finance and people | SAP S/4HANA, Oracle Fusion, TechnologyOne | Same as the distributor | Finance and procurement (SAP, Oracle). HR and payroll (SAP, Oracle HCM). Rostering (RLDatix HealthRoster, UKG Kronos) | SAP S/4HANA or ECC, Oracle. Procurement (Ariba, Coupa). HR and rostering (SuccessFactors, Workday) |
| Safety, incidents and permits | None listed | None listed | Incident management (RiskMan, ims+, VHIMS, RLDatix Datix) | Health and safety (Cority, Enablon, Intelex, Sphera). Permit to work. Critical control checks (Forwood CRM) |
| Documents | OpenText, SharePoint, Objective | Same as the distributor | Scanned medical record | OpenText, SharePoint. Engineering data (AVEVA AIM, Hexagon SDx, Bentley) |
| Outside records that must match | AEMO's market standing data (MSATS) in Australia. The registry in New Zealand | None listed | National patient and practitioner identifiers (IHI and HPI in Australia, NHI in New Zealand) | None listed |
The standards between these systems: the IEC 61968-1 interface model and ISO 55001 asset management in utilities. Health uses national identifiers, SNOMED CT and ICD-10-AM. Energy and mining use ISO 55001, ISO 14224, API MPMS Chapter 20, AMIRA P754 and the JORC Code. Vendor names are examples from industry knowledge (typical, unsourced). The full estates are on the [utilities](/use-cases/utilities), [healthcare](/use-cases/healthcare) and [energy](/use-cases/energy) pages.
## What agents add [#what-agents-add]
There are two ways in. One is the vendor's built-in agent. The other is your own agent, calling the vendor's APIs through governed tools. In 2026, most large vendors made both paths pass through the same permission checks. So the choice turns on model control, price and limits, as the choices below explain.
### The agent works through the system's own controls [#the-agent-works-through-the-systems-own-controls]
Wrap existing systems behind governed tools. Do not rebuild their controls. A tool server carries the caller's identity into the API that already enforces permissions, validation and audit. It is not a new policy engine. Finance, customer, HR and service desk systems hold decades of access rules and approval routing. A second copy of those rules, built for agents, would be weaker.
Four rules follow. Tool calls run as the person who asked, never as a shared service account. Field-level security and sharing rules stay in force. Risky changes go through the system's own approval steps. The audit log names the person who asked.
Write access grows with evidence, like trust in a new colleague. At first a person reviews every change. Review relaxes as the record builds. This is the [autonomy contract](/architecture/autonomy-contract) applied to one permission. The autonomy contract is the agreed level of autonomy, and the controls it needs, for one piece of work.
### Vendors now give outside agents the same checks [#vendors-now-give-outside-agents-the-same-checks]
Four of five large vendors now say outside agents get the same permission checks as their own agents.
* **Salesforce.** Its hosted MCP server became generally available on 14 July 2026. Its own words: "If you can't do it in Salesforce, your agent can't do it through the MCP server" \[vendor].
* **ServiceNow.** Its MCP server became generally available on 5 May 2026. It opens workflows and approval chains to outside agents \[vendor].
* **Workday.** Since 2 June 2026, outside agents inherit its security model, business process controls and audit trail \[vendor].
* **Oracle.** Fusion 26A ships MCP and the agent-to-agent (A2A) protocol \[vendor].
* **SAP is the exception.** Its API policy says that for agent use, A2A through Joule is the only way. It has been enforced since 9 June 2026.
What still differs between the two paths is model control, the price meter, and how far you can customise.
### Matching records across systems [#matching-records-across-systems]
Work that spans several systems breaks on matching records, not on finding them. The same customer has a different identifier in each system. An agent querying three systems has no reliable way to know they describe one customer. In electricity, three records must agree: the network map, the asset register and the market's standing data. They often do not, and that gap drives exceptions. In water, the billing, asset and map systems must agree on the property, the meter and the main.
Reporting definitions built for analysts do not solve this. So work across systems runs on an outside orchestrator, which coordinates the steps through the [integration fabric (R03)](/layers/r03-integration-fabric). Record matching is a named part of it.
### What it costs [#what-it-costs]
Vendors charge for agent activity in four ways, and none of them is a seat. Salesforce charges per action in steps of tokens, so wordy lookups multiply cost \[vendor]. SAP sells prepaid pools of AI units \[vendor]. ServiceNow charges per "assist", by the size of the action \[vendor]. Oracle includes 22 Fusion agents at no extra cost in release 26B \[vendor]. Governance tooling is a fifth line. Microsoft charges $15 per user per month for Agent 365 \[vendor]. So compare total cost, including governance, before you buy. The list prices are in the research block below.
### The parts and where they run [#the-parts-and-where-they-run]
| Part | What it does | Where it runs |
| -------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------- |
| Vendor MCP servers | Expose record APIs as tools, carrying the caller's identity | Salesforce, ServiceNow, Workday, Oracle |
| The system's permission boundary | Checks rights, validates input and routes approvals, as it does for people | Inside each system of record, unchanged |
| Write approvals | Pause risky changes for a person, and track how often people override | The system's own workflow engine |
| Agent register | Records each agent's identity, owner and lifecycle state | Workday Agent System of Record, or Microsoft Agent 365 across vendors |
| Outside orchestrator | Runs work across systems, including record matching | Your integration estate |
| Release tests | Test the vendor's agent on every vendor release | Your build pipeline |
## What must be true before an agent touches it [#what-must-be-true-before-an-agent-touches-it]
**The agent runs as the person who asked.** Never as a shared service account. The [delegation chain](/architecture/delegation-chain) carries that person's identity from the request to the record.
**The system's own checks stay on.** Field-level security, sharing rules and approval routing apply to the agent as they do to people.
**You add the pause.** A built-in vendor agent does not stop for approval by default. Salesforce agents act unless a person's approval step is wired in through Flow. Oracle's approval routing can check whether a person or an agent holds authority. Set the approval step by impact, one of [the four questions](/architecture/agent-types). Impact is what the change can damage, and whether it can be undone. Track the override rate. A falling override rate is the evidence that earns more autonomy.
**You run your own tests on every vendor release.** Vendors can change the model under an agent without notice. No vendor at this layer publishes a notice period for model changes. None lets you pin the model of its own agents. Where you can bring your own model, you can pin it again. A failing test run blocks the release.
**Every agent is registered, with an owner.** Each agent has its own identity, a named owner and a lifecycle state. That is the register stage of the [agent lifecycle](/architecture/agent-lifecycle). Workday gives agents their own user accounts and assigned owners, the way workers get managers \[vendor].
**SAP records take SAP's path.** Plan SAP-held records as a separate integration class, with its own route and price exposure.
The enforcement point is the system of record's own permission boundary. Your own agents reach it through the [tool gateway](/architecture/system-view), one of the seven capabilities an agent platform provides. Vendor agents reach it directly. Both meet the same checks.
## Choices and their verdicts [#choices-and-their-verdicts]
Each entry is the common choice, tested against the simplest credible alternative. The full records are in the [decision catalog](/decisions). For whole packaged applications, see [agents and packaged applications](/use-cases/packaged-applications).
* [The vendor's built-in agent or your own agent through governed APIs](/decisions#cd-17): decide by where the work's authority sits. If it stays inside one system, both paths get the same checks. Choose on model control, price and limits. If it crosses systems, your own orchestration is required.
* **SAP's closed path** is a constraint, not a choice. Two analyst firms criticised it in May 2026. One advised freezing multiyear third-party AI deals that depend on SAP data.
## Concerns this layer must honour [#concerns-this-layer-must-honour]
A concern is a requirement every layer must honour. This layer carries a specific duty for eight of the ten.
* **Identity and access.** Agents act as the person who asked. Permissions stay in the record system. No shared service accounts.
* **Traceability and audit.** The system's own log names the person. Approval decisions are kept.
* **Grounding.** Records across systems are matched. Each definition has an owner.
* **Impersonation and authenticity.** The agent's identity is separate from the person's in the directory.
* **Sovereignty and residency.** Record residency extends to agent memory, logs and derived indexes. Vendor retention and export terms are buying items.
* **Privacy.** HR and customer records carry duties to workers and customers. Agent memory inherits them.
* **Safety and oversight.** Risky writes need approval, set by impact, because built-in agents do not pause by default.
* **Cost.** Per-action meters charge in token steps. Lookups and actions draw from one pool. Governance is priced separately.
The full grid of concerns against layers is the [concern matrix](/architecture/concern-matrix).
## Evidence and limits [#evidence-and-limits]
The vendors' own statements support the main rule: outside agents get the same permission checks as built-in ones. Prices are vendor list prices and they move. Check them before you buy.
The incidents on record are platform security flaws and coding agents deleting databases. No published incident shows a built-in record-system agent corrupting finance or HR records at scale. So patching and safe default settings matter most today.
Three gaps are findings in their own right. No one has published a head-to-head test of a built-in agent against an outside agent on the same task. No one has published a move of a production agent estate between record platforms, so portability claims are untested. No vendor publishes how it manages changes in its agents' behaviour.
## Next step [#next-step]
See this layer at work in [resolving billing exceptions](/use-cases/billing-exceptions), where the billing system keeps every decision about money. Then read the next layer, [line of business and OT (R05)](/layers/r05-lob-and-ot).
Explore this topic
* [Systems of record findings](/library/layers/r04-systems-of-record/findings) and [sources](/library/layers/r04-systems-of-record/sources).
**Vendor paths for outside agents**
* Salesforce announced Headless 360 at its TDX event on 15 April 2026 \[vendor].
* Salesforce's hosted MCP server became generally available on Enterprise editions and above on 14 July 2026 \[vendor].
* Salesforce actions run as the signed-in user, with the same rights, field security and sharing rules \[vendor].
* ServiceNow Action Fabric (5 May 2026) put its MCP server in every Now Assist and AI-native edition \[vendor].
* ServiceNow names Claude, Copilot and homegrown agents as callers \[vendor].
* Workday Agent-Ready Tools and Agent Passport launched on 2 June 2026 \[vendor].
* Workday's Agent System of Record became generally available in February 2026 \[vendor].
* Oracle ships MCP and A2A in Fusion 26A. Published agents become callable over A2A by release 26C \[vendor].
* Salesforce limits: 20 active agents per org, 15 topics per agent, 15 actions per topic, 60-second action timeout.
* Those Salesforce limits are not yet checked against the official limits document.
* SAP API Policy v4/2026, section 2.2.2: "For agentic use cases, A2A via Joule is the only way."
* SAP has enforced that policy since 9 June 2026.
**Pausing and autonomy**
* ServiceNow markets autonomy, with a person in the loop for security containment \[vendor].
* ServiceNow's first-line IT desk agent is generally available, with "91% of cases without reassignment" \[vendor].
**Prices (vendor list prices)**
* A Salesforce standard action is 20 Flex Credits, about $0.10, for up to 10,000 tokens \[vendor].
* An action using 20,001 tokens bills 60 credits ($0.30), three steps rather than two \[vendor].
* An alternative Salesforce meter runs about $2 per 24-hour conversation \[vendor].
* Flex Credits fund lookups, actions and bring-your-own-model calls from one pool \[vendor].
* The pool sits above a Data 360 Starter minimum near $60k a year \[vendor].
* SAP sells prepaid pools of roughly 200 actions per Advanced full use equivalent \[vendor].
* SAP overage runs $0.08 to $0.18 per action \[vendor].
* ServiceNow prices a small agent action at 25 assists and a large one at 150 \[vendor].
* ServiceNow does not publish pool sizes or overage rates. Its own community guidance flags this.
* Roughly half of ServiceNow's new annual contract value is now not priced per seat.
* Oracle includes 22 Fusion agents at no extra cost in release 26B \[vendor].
* Microsoft Agent 365 costs $15 per user per month \[vendor]. Another stack includes governance free.
* Deloitte projects 40 percent of enterprise SaaS spend on usage, agent or outcome pricing by 2030.
* Generic benchmarks show up to fiftyfold cost variation per task ($0.10 to $5.00) at similar accuracy.
**Adoption**
* Salesforce reported Agentforce annual recurring revenue of $800M in Q4 of fiscal 2026 \[vendor].
* Salesforce reported $1.2B in Q1 of fiscal 2027 \[vendor].
* Paid adoption near 6 percent of an installed base of about 150k is derived, not disclosed.
* An analyst forecast: fewer than 15 percent of firms turn on agent features in their automation suites in 2026.
**Incidents**
* ForcedLeak scored 9.4 on CVSS and was patched on 8 September 2025.
* ForcedLeak was an indirect prompt injection through Salesforce Web-to-Lead.
* ForcedLeak leaked CRM data to an expired allowlisted domain, bought for about $5.
* ServiceNow BodySnatcher, CVE-2025-12420, scored 9.3 on CVSS and was patched on 30 October 2025.
* BodySnatcher allowed impersonation without logging in.
* The AppOmni second-order injection came through Now Assist agent discovery.
* In that case, agents ran with the initiating user's rights. Three shipped default settings were the root cause.
* Coding agents deleted development databases at Replit (July 2025) and PocketOS (April 2026).
* One major platform deletes agent memory after 28 days of inactivity, with no documented export.
**Refusals and checks**
* Not relied on: a claim that 3 percent of Joule customers run in production. It has a single, unverified origin.
* Re-verify before buying: meter rates and pool disclosures.
* Re-verify each quarter: SAP's enforcement of its agent policy, and A2A production readiness.