AI Agent Governance for Australian Businesses: The Controls That Make Agents Safe to Run

Updated 14 September 2026: added the short answer, an At a glance governance spec, four question headings, a captioned table mapping each control to Odoo 19 and MYOB Acumatica, the Odoo 19 permission finding from the Enterprise source, MYOB’s AI Automation access rules, links to our MCP and agent register guides, and “Goes well with”. Facts re-verified against the OAIC, the ABS, the National AI Centre and MYOB’s documentation; the OAIC’s automated decision-making guidance is still unpublished as at this date.

AI agent governance comes down to four controls: role-scoped access, so the agent acts as a named user and never as an administrator; a human approval gate on every write to ledger, tax, pricing or stock; an audit trail; and a sandbox-first rollout. From 10 December 2026 the Privacy Act requires privacy policies to disclose significant automated decisions. Our AI agents for ERP in Australia run under all four.

At a glance

• Who it is for: owners, CFOs, financial controllers and operations managers who want AI agents connected to Odoo or MYOB Acumatica without anything posting to the accounts unchecked.
• Problem it solves: the pilot works, then nobody in the room can answer “what happens when the agent gets something wrong in the ledger”, and the rollout stalls.
• Platforms: Odoo 19 Enterprise (built-in agents call only server actions flagged for AI and run as the person chatting); MYOB Acumatica (AI Automation runs under existing access controls and audit logging, through a MYOB-managed proxy that does not store your data); any external agent connected through the API or MCP under its own user account.
• The four controls: role-scoped access, an approval gate on every write, an audit trail per action, and a sandbox-first rollout.
• Approval gate: anything that touches the ledger, tax codes, pricing, stock or a customer-facing message is drafted by the agent and posted or sent by a named person; reads and drafts need no approval.
• Audit trail: what the agent read, what it proposed, who approved it and when, kept in the ERP’s own record history plus the agent platform’s log.
• Policy pack: an AI usage policy staff sign, an agent register, a risk register per agent, an approved-tool allowlist and a permission review schedule.
• Compliance anchors: the National AI Centre’s six essential practices (voluntary, published 21 October 2025), the Australian Privacy Principles, and the automated decision-making disclosure that applies from 10 December 2026.
• Typical cost: governance advisory is available as a standalone engagement, and a single scoped agent pilot typically starts from a few thousand dollars ex GST for discovery and sandbox build, per our AI agent services page.
• Typical timeline: 4 to 10 weeks from discovery to a drafts-first go-live per the same page, then a permission review each quarter.
• What an agent never does: log in as an administrator, post a journal entry, change a tax code, price or stock level, or send a customer or supplier email without a person.
• Last verified: 14 September 2026 against the OAIC’s automated decision-making consultation page, the ABS business AI adoption release and MYOB’s AI Automation documentation.

Most Australian businesses experimenting with AI agents hit the same wall. The pilot works, the demo impresses, and then someone in the room asks the question that stalls everything: what happens when the agent gets something wrong in the accounts?

That question deserves a real answer, not reassurance. AI agent governance is the set of rules, permissions and human checkpoints that determine what an AI agent can see, what it can do, who approves its work before it takes effect, and what record exists afterwards. Done well, it’s the difference between an agent that drafts a supplier payment run for a person to review and an agent that can quietly post journal entries nobody checked.

This post sets out the governance controls we use on every agent we wire into Odoo and MYOB Acumatica for Australian businesses. It maps those controls to the Australian Government’s current guidance, and covers a privacy deadline arriving on 10 December 2026 that most AI content still hasn’t noticed.

What does AI agent governance actually cover?

Strip away the jargon and governance answers four questions about every agent you run.

• Access: what can the agent see? Which records, which modules, whose data. An agent that triages customer service emails doesn’t need to read payroll.
• Action: what can the agent do? Reading and drafting are low-stakes. Creating, updating or deleting records is not. Each action an agent can take should be deliberately granted, not inherited by default.
• Approval: who checks the work? For anything that touches the ledger, tax, pricing or stock, the answer should be a named person, every time.
• Audit: what record exists afterwards? When someone asks why the agent recommended a credit hold in March, you need more than a shrug.

Getting these four answers written down matters more than any tool choice. The Australian Bureau of Statistics reports that around 12% of Australian businesses used AI in 2024-25, and around 35% of large businesses. Very few of them adopted it with anything like this written down first.

Why do agents connected to your ERP raise the stakes?

A chatbot that writes a clumsy paragraph costs you a minute of editing. An agent connected to your ERP operates at a different scale entirely. It can touch hundreds of records in the time it takes you to read this sentence, and ERP records are not drafts. They’re your ledger, your tax position, your stock levels and your customer pricing.

The failure mode isn’t dramatic. It’s quiet. An agent that miscodes GST on supplier bills doesn’t create one visible error, it creates a Business Activity Statement (BAS) discrepancy you’ll discover at quarter end, spread across everything it processed. Large language models make mistakes, and any vendor telling you otherwise is selling something. The engineering response is to design so that mistakes get caught before they post, instead of promising an accuracy figure nobody can stand behind. That design is what the rest of this post is about.

The demand is real, so the governance question isn’t going away. In wholesale distribution, MYOB’s ERP research found 78% of businesses plan to adopt AI in their ERP. The gap between that intent and a safe rollout is exactly the set of controls below.

Australia’s six essential practices, applied to AI agent governance

Australia doesn’t have a standalone AI Act. The current reference point is the National AI Centre’s Guidance for AI Adoption, published on 21 October 2025, which replaced the earlier Voluntary AI Safety Standard. It’s voluntary, but it’s also a sensible checklist, and it sets out six essential practices the Centre calls the AI6. This is what each one looks like when the AI in question is an agent working against your ERP.

• Decide who is accountable. Every agent gets a named owner, a person, not a department. If the reconciliation agent misbehaves, someone specific owns switching it off and cleaning up.
• Understand impacts and plan accordingly. Before an agent goes near a process, write down which records it touches, whose personal information is involved, and who’s affected if it’s wrong.
• Measure and manage risks. Keep a short risk register per agent: what can go wrong, how you’d notice, what the blast radius is. Ten minutes of writing, disproportionate value.
• Share essential information. Staff should know which processes involve an agent and customers shouldn’t have to guess whether they’re corresponding with software.
• Test and monitor. Sandbox first, then ongoing spot checks of approved outputs. Testing continues for as long as the agent runs.
• Maintain human control. For ERP agents this is concrete: a human approval gate on every write to ledger, tax, pricing or stock. Not most writes. Every write.

If you’ve read our broader piece on AI agents for Australian businesses, you’ll recognise these themes. This is the deeper layer: the practices turned into system design.

Should an AI agent act as a person or as an administrator?

As a person, always. The single most common governance mistake we see is the shared super-user. The agent gets an administrator login because it’s easy, and suddenly a piece of software that occasionally hallucinates has more access than your financial controller.

The better pattern is role-scoped access. The agent acts with the permissions of the person who asked, or with a purpose-built role that grants the minimum it needs. A sales rep asking an agent about customer credit status should get an answer scoped to what that rep is allowed to see. The agent should not have a private backdoor to the whole database.

The Australian Cyber Security Centre’s joint guidance on the careful adoption of agentic AI services recommends the same discipline: restrict agent tools to an approved allowlist, log agent activity, and restrict permissions automatically when behaviour looks unexpected. Platform design is starting to reflect this. In Odoo 19 the tools a built-in AI agent can call are server actions an administrator has explicitly flagged for AI use, an allowlist by design, and when a tool runs it executes with the rights of the person chatting, not as an administrator. The catch, which we found in the Enterprise source, is that a tool’s own code can lift itself to administrator rights, and one of the tools Odoo ships does exactly that so a website visitor can leave their details. Copy that pattern into a “look up my order” tool and every order becomes readable to anyone who types a number. Our build review now searches every AI tool for an escalation call. We cover the platform’s built-in features in AI in Odoo and the agent mechanics in AI agents in Odoo.

MYOB Acumatica’s AI Automation takes a similar line. MYOB’s documentation states that before any data is sent to a model the platform enforces existing access controls, user permissions and audit logging, that only authorised users can configure or run prompts, that sensitive values can be masked, and that the MYOB-managed proxy in the middle doesn’t store, modify or retain your data. The feature is subject to licensing, and MYOB warns that providers retire models with little notice, which is a governance point of its own: someone needs to own the connection.

If you connect Claude, Copilot or your own model to either platform through the Model Context Protocol, the same rule applies to the key you hand it. Our MCP for ERP guide walks through read-only versus write-scoped keys for each platform.

Approval gates: drafts first, always

This is the pattern that makes agents safe enough for finance work, using a job we build often.

Each morning an agent reads the overnight bank feed and the open items in the ERP. It matches what it can, and for everything else it drafts a proposed resolution: this deposit looks like invoices 4312 and 4318 paid together short of $12.40, suggest matching both and writing off the difference as a bank fee. The bookkeeper opens a queue of these proposals with their coffee, approves most, rejects a few, and the approved ones post. The agent never posts anything itself. On a messy day the human is still in charge of the mess. The full spec is in our AI reconciliation agent guide.

That’s drafts-first design, and it applies to every pattern we deploy: inbound purchase orders drafted as sales orders, credit control emails drafted for review, service replies drafted but never sent by the agent. The agent removes the repetitive work. The person keeps the judgement and the send button.

“The approval gate isn’t a training-wheels phase you graduate out of. It’s the design. The day someone removes it to save five minutes is the day the agent’s mistakes start posting straight to the ledger.”

Bill Alvarez, Practice Manager, Auboros

What changes for privacy policies on 10 December 2026?

Every agent action, proposal and approval should be logged: what the agent read, what it proposed, who approved it and when. Partly this is operational, because you’ll want to trace errors. Increasingly it’s also regulatory.

From 10 December 2026, amendments to the Privacy Act require organisations to disclose in their privacy policies the kinds of decisions made using substantially automated processes that significantly affect people’s rights or interests, and the kinds of personal information used to make them. The OAIC consulted on its guidance between May and June 2026 and, as at 14 September 2026, hasn’t published it yet; its stated aim is to have it out before the obligation starts.

Think about what that covers in an ERP context. An agent that recommends credit holds on customer accounts is using personal information to do something directly related to a decision that affects someone’s interests. So might automated collections prioritisation or customer-facing pricing decisions. If agents touch decisions like these, your privacy policy will likely need updating before December, and that’s a conversation to have with your privacy adviser now, not in November. We’re not lawyers, but we do design the audit trails that make the disclosure accurate, and the one-page AI agent register that makes it writeable.

Sandbox first: rolling out without betting the ledger

We stage every agent rollout the same way, and recommend the sequence to anyone building their own. MYOB’s own guidance to consultants says the same thing about any change: check it in a test environment before taking it live.

1. Sandbox with a copy of real data. The agent runs against a duplicate of your ERP. Wrong answers cost nothing and teach a lot.
2. Production, drafts only. The agent works on live data but everything it produces sits in a review queue. You’re measuring how often its proposals get approved unchanged.
3. Narrow scope, then widen. Start with one bank account, one customer segment, one document type. Expand when the approval rate has earned it.
4. Scheduled permission reviews. Put a recurring date in the calendar to re-check what each agent can access. Scope creep happens to agents just like it happens to staff accounts.

One prerequisite deserves its own sentence: data hygiene. An agent reasoning over a customer file full of duplicates and stale credit limits will produce confident nonsense. Cleaning the data isn’t a side quest, it’s step zero.

The policy pack: five documents worth having

None of this needs a compliance department. For most mid-sized businesses the whole pack fits in a handful of pages.

• An AI usage policy that staff actually sign: which tools are approved, what data can and can’t go into them, and who to ask. The National AI Centre publishes a policy template alongside the AI6 guidance if you want a starting point.
• An agent register: every agent you run, its owner, what it can access, and what approval gate sits in front of it.
• A risk register per agent: failure modes, how you’d detect them, blast radius.
• An approved-tool allowlist: which models, platforms and connectors are sanctioned, so shadow AI doesn’t creep in through a browser tab.
• A permission review schedule: quarterly is plenty for most businesses.

If you have those five and the drafts-first pattern, you’re ahead of most Australian businesses running AI today, and you’re positioned to expand agent use without the board meeting turning nervous.

Goes well with

• AI agents for ERP in Australia: which agent to start with, what a scoped pilot costs, and how the four controls are built into every engagement.
• MCP for ERP: how to hand Claude, Copilot or your own model a scoped key to Odoo or MYOB Acumatica without giving it the keys to the building.
• The AI agent register: the one page that records every agent, its owner, its permissions and its approval gate, and why the December 2026 disclosure makes it matter.

---

Thinking about AI agents but stuck on the governance question?

Auboros designs and runs drafts-first AI agents over Odoo and MYOB Acumatica from Brisbane, with role-scoped permissions, approval gates and audit trails built in from day one. If you want an agent working your reconciliations, orders or credit control without betting the ledger on it, book a free consultation. We’ll tell you what’s worth automating and what isn’t yet.