The shortcut that causes the damage
The fastest way to give a model access to ERP data is to hand it broad API credentials or read access to the database. It also removes every access control your business spent years defining.
An agent should never hold more authority than the user it is acting for. That principle decides the architecture.
Expose tools, not databases
Instead of general access, define a small set of explicit operations the agent may perform, each with typed inputs and validation. This is the pattern we used to build a Model Context Protocol server against Odoo 17.
- One tool per operation, scoped to a single module
- Inputs validated before anything reaches Odoo
- Odoo access rights enforced for the calling user
- Write operations separated from reads and individually permissioned
If an agent can only call the operations you defined, its worst-case behaviour is bounded by your own business rules.
Keep humans on consequential actions
Reads can be immediate. Writes that affect money, stock or customer commitments should produce a proposal a person confirms.
This is not a limitation of the technology; it is how the system earns trust in the first months of use.
Log everything the agent does
Every request, the resolved user, the tool called, the arguments and the result should be retained. When someone asks why a record changed, the answer must be available in seconds.
Logging also makes evaluation possible: you cannot improve agent behaviour you cannot review.
Start with one workflow
Pick a single high-friction workflow — stock enquiries, quotation lookups, approval summaries — and deliver it properly with permissions and logs in place.
A narrow agent that people trust is worth more than a broad one they are told not to rely on.