A governed agent layer for Dynamics 365 Finance & Operations — agents read F&O data and propose transactions through approval gates, risk ceilings and a full action ledger. Built to order. Built to order by ECOSIRE for Dynamics 365 F&O (build-to-order) — indicative price from $1299.00 USD; request a quote for a scoped proposal.
A governed agent layer for Dynamics 365 Finance & Operations — agents read F&O data and propose transactions through approval gates, risk ceilings and a full action ledger. Built to order.
Built to order
The interesting question about AI in an ERP is not whether a model can draft a purchase order. It is what happens when it does. An assistant that answers questions about your data is low-risk and low-value. An agent that can actually act — release a purchase order, adjust inventory, register a payment — is high-value and, without controls, unacceptable. Most teams end up stuck between the two: a chat window that cannot do anything, or an integration account with broad permissions and no record of why it did what it did.
Dynamics 365 Finance & Operations already has the primitives for the answer. It has a workflow framework with real approval hierarchies. It has role-based security with duties, privileges and segregation of duties rules. It has the database log and audit trail. What it does not have is a layer that forces an AI agent through those primitives instead of around them. That layer is what this toolkit is.
ECOSIRE builds a governed agent framework for Dynamics 365 Finance & Operations as X++ extension models, with no overlayering. The governing principle is simple and enforced in code: an agent never writes directly to F&O. Every agent action follows one path — propose, evaluate against policy, gate for approval where required, execute, record.
Each agent is a first-class record in F&O with its own identity, an explicit allowlist of tools it may call, a risk ceiling, and a rate limit. An agent that is not allowlisted for a tool cannot invoke it, regardless of what a prompt says.
Tools are the only way an agent touches the system. Each tool is a registered X++ class with a declared name, a typed input contract, and a fixed risk level assigned at design time — not chosen by the model. Read tools query data entities: open purchase orders, on-hand inventory, aged receivables, vendor history, production orders. Write tools call the same business logic your users call — sales order creation, purchase requisition submission, inventory adjustment journals, warehouse work — through supported extension points. Financial-commit tools such as posting a journal, registering a payment or approving a purchase order are classified at the highest risk level and are hard-coded to always require human approval, at every autonomy setting. That is not a configuration option that can be turned off.
A proposal from an agent hits the policy gate first: is this tool allowlisted for this agent, is the agent within its rate limit, is the tool's risk level at or below the agent's ceiling, is the agent suspended. Anything that fails is rejected and recorded with the reason — rejections are logged as thoroughly as executions, because a pattern of rejected proposals is exactly what you want to see.
Proposals that pass but exceed the auto-execution ceiling become work items in the standard F&O workflow framework, routed to the approvers your existing hierarchy already defines. The reviewer sees the tool, the exact typed input, and the agent's stated reasoning before approving. Approved actions execute on the batch framework, so long-running or high-volume work is durable and retried under your control rather than tied to a session.
Every proposal, decision and execution is written to an append-only action ledger: which agent, which tool, the full input, the policy outcome, who approved it, what the execution returned, how long it took, and which model and prompt version produced it. The ledger is queryable in F&O, exposed as a data entity for Power BI, and exportable. When someone asks in six months why a credit limit was raised, the answer is a record, not a reconstruction.
Agents are dialled through named autonomy levels rather than a scatter of individual switches. At the lowest level an agent only suggests and every action needs approval. Higher levels permit low-risk read and draft actions to execute automatically, then progressively more, with a digest of what ran. The highest level still never auto-executes a financial commit. Moving an agent up a level is an explicit, logged administrative action, and any agent can be suspended immediately — suspension is checked at the policy gate, so in-flight proposals stop too.
Agents are grounded in your data through retrieval over F&O entities and, where you want it, your document estate — so an answer about a vendor cites the purchase orders and invoices it came from rather than being generated from a model's general knowledge. The framework is model-agnostic and connects to the AI service you nominate; where you already run Power Platform, agents can be surfaced through Power Automate or a conversational front end, and Dual-write is used only if you run it and want customer-engagement context alongside F&O.
Organisations on Dynamics 365 Finance & Operations that want AI agents doing real operational work — chasing overdue receivables, triaging exceptions, drafting replenishment — but operate under audit, segregation-of-duties or regulatory requirements that make an unmonitored assistant a non-starter. It suits finance, supply chain and shared-service teams with high-volume repetitive judgement work and a low tolerance for unexplained changes.
This is a build-to-order engagement.
1. Scoping call. We identify the two or three agent use cases worth building first, the exact tools each needs, the risk classification of each tool, your approval hierarchy, and which AI service you will use. We review your F&O version, security model and existing customisations. 2. Fixed quote. You receive a written scope listing every tool to be built with its risk level, the policy and autonomy model, the ledger and reporting surface, and a fixed price and timeline. Typical build time is two to four weeks depending on tool count and integration complexity. 3. Build. We develop the framework and the scoped tools against a build environment matching your version, with tests covering the policy gate, the approval path and the ledger. 4. Install in test. The deployable package goes to your sandbox through LCS. Agents start at the lowest autonomy level — suggest only — so your team can review a period of real proposals and decide what is safe to automate before anything executes on its own. 5. Production. After sign-off the package is promoted through your LCS pipeline. Agents go live at the autonomy level you choose, and you raise it when the ledger gives you reason to. 6. Support. A defined support window follows go-live, covering defects, tool configuration and adding tools to the registry.
You own the extension source, the tool definitions and the ledger data. Nothing about the governance model depends on ECOSIRE remaining in the loop.
A short call to confirm the workflow, your platform version and where the integration boundaries sit.
You receive a written scope and a fixed price. Nothing is built until you approve it.
We develop against a copy of your configuration and test it there. Typically two to four weeks.
We install on your instance, hand over the source, and support it for twelve months.
Wants AI to chase overdue receivables and draft the follow-ups, but cannot accept anything that might post or settle without a human decision and a record of it. Financial-commit tools always require approval, and the ledger shows exactly what was proposed, by which agent, on what input, and who decided.
Has high-volume repetitive judgement work — replenishment suggestions, exception triage, vendor follow-up — that consumes planner time without needing planner expertise on every case. Low-risk read and draft tools can run automatically at a chosen autonomy level while anything that commits stock or money stops for review.
Is asked to approve AI in the ERP and has no way to answer what an agent may do, what it did, or how to stop it. Allowlists, risk ceilings, an immediate suspend switch and an append-only ledger turn those into concrete, queryable answers rather than assurances.
| Criterion | ECOSIRE | Custom Build | Competitor |
|---|---|---|---|
| Agent actions gated by an explicit tool allowlist and risk ceiling | Included | Partial support | Not included |
| Financial commits can never auto-execute, at any autonomy level | Included |
From $1299.00
Starting point — quoted to your scope
| Not included |
| Approvals routed through the standard F&O workflow hierarchy | Included | Partial support | Not included |
|---|
| Append-only ledger of proposals, rejections, approvals and results | Included | Partial support | Not included |
|---|
| Writes call existing business logic, not direct table updates | Included | Partial support | Partial support |
|---|
| Agent work executed durably on the F&O batch framework | Included | Partial support | Not included |
|---|
| Model-agnostic, running on your own AI subscription and keys | Included | Included | Not included |
|---|
| Extension source and tool definitions delivered to you, no overlayering | Included | Partial support | Not included |
|---|
An X++ extension that imports bank statements into Dynamics 365 F&O and fuzzy-matches lines against payments, deposits and fees. Built to order for your legal entities after a scoping call and fixed quote.
A behaviour-aware treasury forecasting app for Dynamics 365 Finance & Operations. Built to order as an X++ extension after a scoping call and a fixed quote — nothing is pre-built or downloadable today.
A built-to-order forecasting and planning layer for Dynamics 365 Finance & Operations, with external demand signals, explainable forecasts and scenario comparison. Scoped and built by ECOSIRE after a fixed quote.
A build-to-order X++ extension that captures vendor invoices, extracts line data, matches them against purchase orders with tolerance rules and routes exceptions through F&O workflow. ECOSIRE builds it for your entity structure after a fixed quote.