AI Agent Governance for Australian Businesses: The Controls That Make Agents Safe to Run

Most Australian businesses experimenting with AI agents hit the same wall. The pilot works, the demo impresses, and then someone in the room asks the question that stalls everything: what happens when the agent gets something wrong in the accounts?

That question deserves a real answer, not reassurance. AI agent governance is the set of rules, permissions and human checkpoints that determine what an AI agent can see, what it can do, who approves its work before it takes effect, and what record exists afterwards. Done well, it’s the difference between an agent that drafts a supplier payment run for a person to review and an agent that can quietly post journal entries nobody checked.

This post sets out the governance controls we use when wiring AI agents into Odoo and MYOB Acumatica for Australian businesses. It maps those controls to the Australian Government’s current guidance, and covers a privacy deadline arriving on 10 December 2026 that most AI content hasn’t noticed yet.

What AI agent governance actually covers

Strip away the jargon and governance answers four questions about every agent you run.

• Access: what can the agent see? Which records, which modules, whose data. An agent that triages customer service emails doesn’t need to read payroll.
• Action: what can the agent do? Reading and drafting are low-stakes. Creating, updating or deleting records is not. Each action an agent can take should be deliberately granted, not inherited by default.
• Approval: who checks the work? For anything that touches the ledger, tax, pricing or stock, the answer should be a named person, every time.
• Audit: what record exists afterwards? When someone asks why the agent recommended a credit hold in March, you need more than a shrug.

Getting these four answers written down matters more than any tool choice. The Australian Bureau of Statistics reports that around 12% of Australian businesses used AI in 2024-25, and around 35% of large businesses. Very few of them adopted it with anything like this written down first.

Why agents connected to your ERP raise the stakes

A chatbot that writes a clumsy paragraph costs you a minute of editing. An agent connected to your ERP operates at a different scale entirely. It can touch hundreds of records in the time it takes you to read this sentence, and ERP records are not drafts. They’re your ledger, your tax position, your stock levels and your customer pricing.

The failure mode isn’t dramatic. It’s quiet. An agent that miscodes GST on supplier bills doesn’t create one visible error, it creates a Business Activity Statement (BAS) discrepancy you’ll discover at quarter end, spread across everything it processed. Large language models make mistakes, and any vendor telling you otherwise is selling something. The honest engineering response is to design so that mistakes get caught before they post, rather than promising an accuracy figure nobody can stand behind. That design is what the rest of this post is about.

The demand is real, so the governance question isn’t going away. In wholesale distribution, MYOB’s ERP research found 78% of businesses plan to adopt AI in their ERP. The gap between that intent and a safe rollout is exactly the set of controls below.

Australia’s AI6 practices, applied to AI agent governance

Australia doesn’t have a standalone AI Act. The current reference point is the National AI Centre’s Guidance for AI Adoption, published in October 2025, which replaced the earlier Voluntary AI Safety Standard. It’s voluntary, but it’s also a sensible checklist, and it sets out six essential practices. Here’s what each one looks like when the AI in question is an agent working against your ERP.

• Decide who is accountable. Every agent gets a named owner, a person, not a department. If the reconciliation agent misbehaves, someone specific owns switching it off and cleaning up.
• Understand impacts and plan accordingly. Before an agent goes near a process, write down which records it touches, whose personal information is involved, and who’s affected if it’s wrong.
• Measure and manage risks. Keep a short risk register per agent: what can go wrong, how you’d notice, what the blast radius is. Ten minutes of writing, disproportionate value.
• Share essential information. Staff should know which processes involve an agent and customers shouldn’t have to guess whether they’re corresponding with software.
• Test and monitor. Sandbox first, then ongoing spot checks of approved outputs. Testing continues for as long as the agent runs.
• Maintain human control. For ERP agents this is concrete: a human approval gate on every write to ledger, tax, pricing or stock. Not most writes. Every write.

If you’ve read our broader piece on AI agents for Australian businesses, you’ll recognise these themes. This is the deeper layer: the practices turned into system design.

Permissions: an agent should act as a person, not as an administrator

The single most common governance mistake we see is the shared super-user. The agent gets an administrator login because it’s easy, and suddenly a piece of software that occasionally hallucinates has more access than your financial controller.

The better pattern is role-scoped access. The agent acts with the permissions of the person who asked, or with a purpose-built role that grants the minimum it needs. A sales rep asking an agent about customer credit status should get an answer scoped to what that rep is allowed to see. The agent should not have a private backdoor to the whole database.

The Australian Cyber Security Centre’s joint guidance on the careful adoption of agentic AI services recommends the same discipline: restrict agent tools to an approved allowlist, log agent activity, and restrict permissions automatically when behaviour looks unexpected. Platform design is starting to reflect this. In Odoo 19, for example, the tools an AI agent can call are server actions a developer has explicitly flagged for AI use, an allowlist by design. We cover the platform’s built-in features in AI in Odoo and the agent mechanics in AI agents in Odoo.

Approval gates: drafts first, always

Here’s the pattern that makes agents safe enough for finance work, using a job we build often.

Each morning an agent reads the overnight bank feed and the open items in the ERP. It matches what it can, and for everything else it drafts a proposed resolution: this deposit looks like invoices 4312 and 4318 paid together short of $12.40, suggest matching both and writing off the difference as a bank fee. The bookkeeper opens a queue of these proposals with their coffee, approves most, rejects a few, and the approved ones post. The agent never posts anything itself. On a messy day the human is still in charge of the mess.

That’s drafts-first design, and it applies to every pattern we deploy: inbound purchase orders drafted as sales orders, credit control emails drafted for review, service replies drafted but never sent by the agent. The agent removes the repetitive work. The person keeps the judgement and the send button.

“The approval gate isn’t a training-wheels phase you graduate out of. It’s the design. The day someone removes it to save five minutes is the day the agent’s mistakes start posting straight to the ledger.”

Bill Alvarez, Practice Manager, Auboros

Audit trails and the 10 December 2026 privacy deadline

Every agent action, proposal and approval should be logged: what the agent read, what it proposed, who approved it and when. Partly this is operational, because you’ll want to trace errors. Increasingly it’s also regulatory.

From 10 December 2026, amendments to the Privacy Act require organisations to disclose in their privacy policies the kinds of decisions made using substantially automated processes that significantly affect people’s rights or interests, and the kinds of personal information used to make them. The OAIC is consulting on its guidance now and expects to publish it before the obligation starts.

Think about what that covers in an ERP context. An agent that recommends credit holds on customer accounts is using personal information to do something directly related to a decision that affects someone’s interests. So might automated collections prioritisation or customer-facing pricing decisions. If agents touch decisions like these, your privacy policy will likely need updating before December, and that’s a conversation to have with your privacy adviser now rather than in November. We’re not lawyers, but we do design the audit trails that make the disclosure honest.

Sandbox first: rolling out without betting the ledger

We stage every agent rollout the same way, and recommend the sequence to anyone building their own.

1. Sandbox with a copy of real data. The agent runs against a duplicate of your ERP. Wrong answers cost nothing and teach a lot.
2. Production, drafts only. The agent works on live data but everything it produces sits in a review queue. You’re measuring how often its proposals get approved unchanged.
3. Narrow scope, then widen. Start with one bank account, one customer segment, one document type. Expand when the approval rate has earned it.
4. Scheduled permission reviews. Put a recurring date in the calendar to re-check what each agent can access. Scope creep happens to agents just like it happens to staff accounts.

One prerequisite deserves its own sentence: data hygiene. An agent reasoning over a customer file full of duplicates and stale credit limits will produce confident nonsense. Cleaning the data isn’t a side quest, it’s step zero.

The policy pack: five documents worth having

None of this needs a compliance department. For most mid-sized businesses the whole pack fits in a handful of pages.

• An AI usage policy that staff actually sign: which tools are approved, what data can and can’t go into them, and who to ask. The National AI Centre publishes a policy template alongside the AI6 guidance if you want a starting point.
• An agent register: every agent you run, its owner, what it can access, and what approval gate sits in front of it.
• A risk register per agent: failure modes, how you’d detect them, blast radius.
• An approved-tool allowlist: which models, platforms and connectors are sanctioned, so shadow AI doesn’t creep in through a browser tab.
• A permission review schedule: quarterly is plenty for most businesses.

If you have those five and the drafts-first pattern, you’re ahead of the overwhelming majority of Australian businesses running AI today, and you’re positioned to expand agent use without the board meeting turning nervous.

---

Thinking about AI agents but stuck on the governance question?

Auboros designs and runs drafts-first AI agents over Odoo and MYOB Acumatica from Brisbane, with role-scoped permissions, approval gates and audit trails built in from day one. If you want an agent working your reconciliations, orders or credit control without betting the ledger on it, book a free consultation. We’ll tell you what’s worth automating and what isn’t yet.