AWS ERP Agent: Deny-by-Default, Separate Identity

AWS is introducing a new framework to automate complex financial tasks for large companies. This framework uses a single AI agent to handle exceptions in systems like SAP, which typically require manual intervention from accounts receivable teams. The system runs on Amazon Bedrock AgentCore and uses Strands, an open-source agentic SDK. The AI agent reads standard operating procedures written in plain language, then resolves exceptions across SAP and other connected systems. Business teams manage these procedures, so updating an exception handling process means editing the SOP, without touching code. Earlier automation methods struggled with this kind of work, but foundation models now allow agents to reason over written procedures and call tools across system boundaries. What's interesting is how trust is built: agents begin in advisory mode, with humans taking every action. As confidence grows, they move to supervised execution, and eventually to autonomous resolution, acting independently only when confidence is high enough. The design emphasizes determinism, using layered controls to ensure consistent behavior from language models. This includes controlled model parameters, structured prompts, and retrieval from approved content. The bottom line is that every action is tied to an identity, allowing compliance teams to distinguish between agent-initiated and human-approved actions, which is important for audit requirements.