The corporate IT landscape is undergoing a fundamental shift. The era of experimental conversational chatbots is transitioning into the design of autonomous Multi-Agent Systems (MAS) capable of independently executing complex end-to-end business processes. However, architects face a complex challenge: how to integrate autonomous agents into existing ERP and ECM landscapes while maintaining data consistency, role-based access control (RBAC), and auditability without creating unmanaged security risks.
To prevent the emergence of Shadow IT, MAS development requires a shift from the "AI magic" hype toward strict engineering discipline. Autonomous agents are not a quick plug-and-play solution for legacy ERPs, nor can they fully replace humans in critical business processes. Their integration requires a robust architectural foundation.
From chatbots to autonomous agents: why enterprise AI requires engineering discipline
Multi-agent systems are distinguished by the fact that agents interact not only with humans but also with each other and external information systems. In practice, infrastructure costs and governance efforts for enterprise multi-agent systems typically far exceed the resources required for the initial fine-tuning of the AI models themselves.
To build stable systems, architects must rely on proven methodologies. Regular architectural reviews, such as those defined in the AWS Well-Architected Framework, are a mandatory element for identifying risks before they turn into incidents in a production environment. This ensures reliability, security, and operational excellence when scaling solutions.
Anatomy of the excessive agency risk: when an agent acts beyond its authority
One of the greatest threats when integrating autonomous systems is so-called "excessive agency." The OWASP organization, in its list of risks for GenAI applications for 2025, classifies excessive agency as a critical risk. It occurs when an agent is granted overly broad permissions and performs actions outside its intended functionality due to a lack of permission validation.
A typical example is an autonomous agent tasked with processing invoices. Without strict role-based access control (RBAC), it could initiate unauthorized financial transactions in an ERP. Another example is interdepartmental data reconciliation, where agents are required to record every decision in an immutable audit trail to comply with corporate governance requirements. To create a structured security perimeter, architects apply the NIST AI RMF 1.0 standard, which bases AI risk management around four key functions: Govern, Map, Measure, and Manage.
MAS architectural patterns: domain isolation and a unified data model
To avoid chaotic agent access to systems, MAS architecture must be built on the principles of Domain-Driven Design (DDD). As Martin Fowler and James Lewis note in their definition of microservices architecture, service boundaries should align with business domains rather than technical layers. This means each agent must operate exclusively within its isolated context and have a clear integration contract.
Beyond responsibility isolation, the architecture must solve the problem of fragmented data. Using a unified data model ensures that agents work with a single source of truth rather than relying on disparate departmental silos, which reduces the risk of logic conflicts in their interactions.
Security and audit: how to integrate agents into the ERP/ECM perimeter
Any agent interaction with corporate data must pass through a strict API contract. An agent should not have direct access to the database. All requests pass through permission validation mechanisms to prevent unauthorized actions. Observability is equally important. Well-designed systems should have service level indicators (SLIs) that allow human operators to intervene in agent workflows within minutes of detecting an anomaly.
Platform approach: building MAS using Intecracy Group tools
Designing multi-agent systems from scratch creates a high infrastructure burden. An optimal solution for the enterprise is to use proven platforms that already contain built-in security and audit mechanisms. For example, Softengi (which is certified to the ISO/IEC 42001:2023 AI management standard) develops enterprise MAS using technological solutions from the Intecracy Group alliance.
The foundation for such architectures is the low-code platform UnityBase (a joint development of Intecracy Group companies, where InBase is a key, but not the only, developer). UnityBase offers a domain metadata concept that combines data descriptions, APIs, and security rules into a single model. In commercial editions, the platform provides mechanisms for role-based access control (RBAC), row-level security (RLS), access control lists (ACL), and immutable audit trail logging. This creates an isolated security layer that minimizes the risks of excessive agency.
For orchestrating agent logic, the Scriptum BPM platform from InBase (based on BPMN/Camunda standards) is used. This allows the interaction of a multi-agent system to be described as a clearly managed business process. The "AI Center" module ensures LLM-agnosticism, allowing different models (from OpenAI to local open-source solutions) to be connected to specific nodes of the process without changing the unified integration contract. This platform approach turns multi-agent systems into a reliable, secure, and auditable tool for enterprise architecture.
Architect's checklist for preparing infrastructure for MAS deployment
- Define bounded contexts for each agent according to DDD principles.
- Implement end-to-end RBAC/ABAC at the API level called by agents.
- Configure an immutable audit trail to record AI decisions and actions.
- Create a single source of truth through a unified platform data model.
- Integrate observability metrics (SLIs) for human intervention in anomalous workflows.
FAQ
How can unauthorized actions by autonomous agents be prevented in an ERP system?
It is necessary to implement a robust security architecture where agents do not have direct access to databases. Every API call from the AI must pass through authorization (e.g., RBAC/RLS), ensuring that actions are performed strictly within the scope of the agent's defined business role.
Which architectural frameworks are best suited for designing multi-agent systems?
To ensure reliability, it is recommended to combine Domain-Driven Design (DDD) principles for clear isolation of each agent's domain boundaries with the AWS Well-Architected Framework to ensure overall security and operational excellence.
How can MAS compliance with NIST AI RMF 1.0 and OWASP Top 10 be ensured?
Management processes should be structured around the Govern, Map, Measure, and Manage functions (per the NIST standard), and the risk of excessive agency (per the OWASP classification) must be mitigated through the implementation of immutable audit trails and strict role-based control.