Eighty-two percent of security executives are confident their existing policies protect them from unauthorised AI agent actions. Eighty-eight percent of organisations had a confirmed or suspected AI agent security incident in the past year. Both numbers come from the same population, surveyed for Gravitee's State of AI Agent Security 2026 report (900+ executives and technical practitioners). Confidence and reality are not the same measure.
At the.good.code; we build custom software and operational layers for manufacturers and operations-led businesses, and we are a certified Open Mercato agency and open-source contributor. When manufacturers come to us planning an AI-native ERP implementation, most of them are picturing a chat window that answers questions about inventory. That is the easy 5% of the problem. The hard 95% is what happens the moment that same agent gets permission to write.
What "AI-native" usually means, and what it needs to mean
Most systems marketed as AI-native bolt a conversational interface onto an existing database and call the result intelligent. A chat interface is a UI decision. It sits on top of whatever access control already existed underneath it, and it inherits every weakness that access control had before anyone added AI to the sentence.
Ask a vendor demoing an AI-native ERP one question: what happens when the agent tries to change a customer's payment terms, or delete a line from a purchase order? If the answer is a shrug, or "it just does it," you have found the chat window standing on nothing.
Three things that have to be true before an agent touches production data
The agent inherits the operator's permissions, nothing wider. An agent should never have a wider door into your data than the person operating it. In Open Mercato's architecture, an AI assistant scoped to a domain such as customers or catalog inherits the role and permissions of the operator running it: it sees only the records that operator can see, under the same role-based access rules that already govern every human user. Give the operator no access to pricing, and the agent has no access to pricing either. That is not a policy someone remembers to write down. It is enforced the same way the rest of the permission system is enforced.
A write goes through a proposal step before it commits. Open Mercato's AI Assistant ships with three declared modes rather than one blanket setting. Read-only refuses to write anything, full stop, and is the default for assistants that only need to search or summarise. Confirm-required packages a proposed change as a card with a field-level diff of exactly what would change, and nothing commits until a human clicks Confirm; this is the default for actions on customer accounts and catalog merchandising. Destructive-confirm-required adds the same gate specifically for deletions and cascading changes. An administrator can tighten any of these settings, never loosen them below what the mode declares, and an unconfirmed proposal expires after 15 minutes, so an old suggestion cannot resurface days later and get approved by someone who has forgotten the context.
Every action leaves a trail someone can undo. Every create, update and delete gets logged with the actor, the scope, and a snapshot of the record before and after the change. Undo works today for part of that surface, including directory records, authentication and sample data, and reaches further as individual modules add their own handlers. That partial coverage is worth stating precisely, module by module, rather than rounding up to a single headline percentage that nobody can check against the code.
Governance has to keep pace with production
The data backs this up from both directions. In LangChain's 2026 State of Agent Engineering survey of 1,340 practitioners (fielded 18 November to 2 December 2025), 57% already have agents running in production, rising to 67% among enterprises with 10,000 or more employees. Observability tooling for these agents sits at 89% adoption, but only 52% have moved on to systematically evaluating what the agent actually did, and 60% of teams still fold a human into that evaluation rather than trusting automated judging alone. Watching an agent is a different skill from deciding whether what it did was correct, and most teams have built the first without finishing the second.
Gravitee's numbers describe the same gap from the security side. 81% of organisations are past the planning stage with AI agents, yet only 14.4% report full security approval for the agents they have live, and only 21% have real visibility into what those agents can access or which tools they call. Production adoption and the ability to govern it are moving at different speeds, and the incidents in the opening statistic come from exactly that gap.
Where we stand on this
We build on Open Mercato, and we are a certified Open Mercato agency and open-source contributor. The reason ties directly to the three mechanisms above: because the core is MIT-licensed, the permission inheritance, the confirm-required envelopes and the audit log are not claims in a sales deck, they are code sitting in a public repository that a client's own engineers, or a different agency's, can read line by line before trusting any of it. That is a different kind of proof than a vendor's word, and it is the kind we consider necessary for anything that can write to a customer record or a production order.
The claim "AI-native" is only as strong as the answer to the three questions above. Most vendor demos show what the assistant can do when everything goes right. Few show what stops it when something goes wrong, and that second answer decides whether the system is safe to leave unattended.
Ask this instead of watching the chat demo
If you are evaluating any platform pitched as AI-native, skip the chat demo and ask one question: what happens when your agent gets something wrong and writes it to a live customer order. A vendor with a real architecture answers with a mechanism: whose permissions apply, what confirmation is required, what gets logged. One without an architecture answers with reassurance instead of specifics.
Sources
- Gravitee, State of AI Agent Security 2026 Report (900+ executives and technical practitioners surveyed)
- LangChain, State of Agent Engineering (1,340 respondents, fielded 18 November to 2 December 2025)
- Open Mercato, AI Assistant and Audit & Undo documentation