What context does a bot need before acting on an ERP?

An ERP is not a database with an API in front of it. It is a set of operational agreements that have been settling for years, and a good part of them is not written down in any documentation.

Before an agent writes anything, it needs five things. Which identity it uses and what permissions that identity has, which almost never match those of the user who launched the process. Which operations are idempotent, because a retry on one that is not duplicates an entry. Which fields are business fields and which are technical, so as not to correct a piece of data somebody adjusted by hand for a reason. Which closing windows exist, because a correct write at the wrong time is an accounting problem. And which action requires human authorisation before being executed.

We have learned to declare those five things as explicit policies and not as code inside the agent. What is not declared does not happen: the agent cannot invoke a tool that does not have a typed contract and an associated permission.

The most useful side effect has been conversational. Writing this list with the operations team brings to the surface exceptions nobody remembered, and those exceptions usually explain the process better than the manual does.