Can AI run a manufacturing ERP safely?

The useful work is mostly reading. An assistant that can see the stock ledger, open work orders, purchase orders and job costs can answer questions that otherwise take a report and a spreadsheet: which jobs are short of material, what a bracket cost last month against the quote, how much sheet to order for next week's work orders. It should see exactly what the user asking could see on screen, and nothing more.

That rule, the assistant inherits the user's role, is the first thing to check with a vendor. An assistant with its own wider access is a way around the permission model, however well behaved.

The actions below change what the business owns, owes or has promised. Each should require a person to approve the specific change before it posts, every time.

• Post a stock movement, including adjustments and scrap.
• Create, approve or send a purchase order, invoice, bill or payment.
• Change the status of a work order, inspection or sales order.
• Edit a bill of materials, a routing, a price or a work-centre rate.
• Change a user's role or permissions, or create API keys.
• Delete or overwrite any record, which a good system does not allow anyone to do.

The safe pattern is draft and approve. The assistant fills in a form, proposes a change or writes a workflow rule; a person reads it, changes it if needed, and saves it under their own name. The record then shows who approved it, when, and that an assistant drafted it. With an audit log of every change and an immutable ledger, a bad proposal that slipped through is visible and reversible with a correcting entry.

Rate limits matter too. An assistant with unlimited requests can be driven by a mistake, or by a prompt hidden in a pasted document, to generate hundreds of proposals. A cap per person keeps the blast radius small.