Many Organizations Cannot Fully Verify What AI Agents Do in Business Systems

Pathlock’s AI Governance Gap Report finds AI agents creating and modifying business records, approving transactions, and executing workflows across systems in core ERP-driven processes, often without the traceability, visibility, and accountability those processes call for.

Of the organizations Pathlock surveyed, 38% allow agents to create or modify records such as vendors, customers, or materials, and 28% allow them to approve transactions or requests. Yet 52% cannot fully verify every action agents execute across business systems. Chris Radkowski, a GRC expert at Pathlock, says that once AI becomes part of how transactions are executed, governance “stops being just an IT concern and becomes a matter of business risk, financial control, and compliance.”

Pathlock’s findings come from a May 2026 survey of 286 IT, compliance, and security decision-makers at organizations that run or plan to run AI agents. Among respondents, SAP S/4HANA is the most widely used application, at 37%, and SAP ECC runs in 24%.

How Agent Permissions Differ From User Permissions

Agents change what a permission can do. Radkowski notes that they can run continuously, call application APIs directly, and adapt to inputs without following fixed scripts.

A misconfigured permission for a human user typically produces a localized problem, while the same misconfiguration on an agent can spread across many transactions before anyone detects it. “The blast radius is structurally larger,” Radkowski said.

Direct database access is one area of concern. In 25% of surveyed organizations, agents have direct access to backend databases, which Pathlock notes raises the risk of changes that bypass application-level business logic.

Financial processes present another concern. Some 36% of respondents are running or implementing agents in finance and accounting, where their activities may involve decisions and transactions traditionally subject to human oversight and approval.

Organizations do have governance in place: about a third report a formal AI agent policy, and a similar share keep separate audit logs for agent actions. Pathlock notes that many of these controls reflect human-centric approaches, and 23% of respondents had an agent incident in the past 12 months that required investigation, remediation, or escalation.

Controls built around people leave oversight gaps once agents are adopted. In SAP systems, those controls include authorization roles, which define who can approve what. SAP describes Joule Assistants, for example, as working within a customer’s existing authorizations and audit trails, so a role misconfigured for an agent carries the blast radius Radkowski describes.

Organizations Often Cannot Show What an Agent Did

Susan Stapleton, a GRC expert at Pathlock, points to what comes after authorization: “For decades, governance focused on controlling who could access a system. AI agents introduce a different challenge: understanding what actually happened after access was granted.”

Many organizations lack that visibility. Only 19% of respondents report complete, real-time visibility into agent actions, while 48% cannot trace an agent’s activity end to end across systems. Pathlock notes that traditional tools record the credential used, which makes it difficult to reconstruct the sequence of actions an agent performed.

The problem grows when agents work across multiple applications. Many respondents use applications such as SAP, Salesforce, and Workday, and agent activity that spans several of them can leave records in separate audit trails. Investigators must piece those records together to establish what happened.

Incident response depends on those records. If a questionable action were flagged today, 18% of respondents say they could complete an investigation within hours, while 22% could not investigate reliably at all. Pathlock links effective investigation to containing incidents, identifying root causes, and demonstrating compliance.

Stapleton adds that the organizations best prepared for AI “will be those that can verify, trace, investigate, and explain AI-driven actions.”

AI Agents Need Human Ownership and Clear Accountability

Pathlock’s recommendations start with ownership, because clear accountability helps ensure that agent deployments are reviewed, monitored, and aligned with organizational controls.

Only 17% of organizations have a team or officer dedicated to AI governance. Another 79% have none: existing functions such as IT, security, compliance, or the deploying business unit hold the role in 64%, and 15% report no clear owner.

Pathlock holds that responsibility should not stay undefined or distributed. The stakes help explain why: respondents rank financial risk from incorrect transactions third among concerns, behind security and compliance, and Radkowski ties that ranking to what agents now do. “As AI agents begin creating vendors, approving requests, and influencing transaction flows, AI governance failures can quickly become control failures.”

Take the report’s own example of a consequential agent action: modifying a vendor record. Pathlock recommends treating the agent as an identity, with access granted for a specific business task and reviewed regularly. Excessive permissions can quickly turn into significant business risk, and narrow access limits how far a misconfiguration can spread.

Its actions should be logged separately from human activity and monitored continuously, with a complete view of how the agent operates across systems and business processes. The record should also make each action traceable and explainable, showing what happened, why the agent decided as it did, and how the outcome was produced.

If the result turns out to be wrong, Pathlock recommends having investigation procedures, response playbooks, and audit capabilities written for agent-driven events.

The aim is to identify root causes, assess impact, and demonstrate compliance quickly, and Pathlock describes traceability and explainability as becoming foundational requirements for governance and regulatory readiness.

Radkowski expects people to keep adopting technology that helps them work faster or with less repetitive effort, so the challenge, in his words, is “ensuring that AI is adopted within governance and security frameworks.”

What This Means for SAPinsiders

Governance is shifting from access to activity. SAP’s authorization roles settle who may act, and SAP describes Joule Assistants as working within them. What remains is whether organizations can show what an agent did with that access, and Pathlock’s survey finds many cannot.

Audit evidence now spans several systems. An agent working across applications can leave records in separate audit trails, and Pathlock says organizations without traceability and investigation capabilities struggle to demonstrate compliance. Showing an auditor what an agent did therefore means piecing those records together.

Agent oversight cuts across functions. In most organizations, responsibility for agent governance sits with existing functions such as IT, security, compliance, or the deploying business unit. Radkowski warns that governance failures can quickly become control failures, so security, finance, and compliance all have a stake in who owns it.