AI, Frappe, ERPNext, PR's and the delima all of us have

ERPNext
, , , ,
1

Hey Family - it’s John.

I wanted to try and share my thoughts about our current situation in the community and as a whole the World with AI and it’s impact on us all. As someone who’s found AI to be the key to unlocking 36+ years of technical knowledge and expertise into a complete development farm, well I mean some of you may not even understand that capability. And that’s issue one.

One - We are all at different levels of understanding of where AI and the code is, where we want it to go, and how we see AI interacting into each of those principles. Using AI as my hands, has allowed my brain to breathe. It’s the only way i know howto explain it. I’ve learned that i see in images and patterns. Literally learning something about yourself 55 years into this game sucks, let me tell you. If it weren’t for the way I use AI, it never would’ve came to light this easy. So for some of us, AI is fluid like water, to others it’s stupid and can only accomplish a single task, and not consecutive without error. Which leads me into issue two.

Two - Open source software is by all means LLM’s. We have to start thinking that way. I for one have loved OSS since the early 90’s. Seriously, from the earliest days of my life has been around open source software or some pirated pieces of puzzles to accomplish the whole. None of us are here because we believe in paying extreme amounts of money to software, we have no problem paying for the services around software. Afterall it’ takes some knowledge and experiences to build all these apps and to continue the solutions into the future. Let’s just be honest about it, we are all the hands that deploy, touch and support the ERPNext/Frappe world, which has exposed itself as the third issue.

Three - AI can and has delivered PR’s and changes to opensource software so fast that the human cannot keep up or even try too. Not because we don’t want the help, its because the community has no guardrails. The AI will take the tdd to heart and continue until the loop is closed, if we had guardrails the AI would still need one person per doctype, per app, per thread that understands it all to help bound those updates, fixes et al. Which leads us into the fourth issue on my list is who’s holding all that together? Frappe cannot and that’s where we all are.

Four - All of us want to help and make Frappe/ERPNext the best opensource erp solution across the world, at least Ive been trying. The inability to participate via updates/fixes et all has plagued me because I truly believe the problems ive found on my local copies, can be resolved across the board in days, not weeks, but days. that’s all of our problem now. From the enduser/consultant/part-time dev, how do you help without hurting, and as Frappe is dealing with it - How do we allow the good ones and not loose our own roadmap and or free for all. As a retired dot com person, I see it everywhere in images and patterns, but my end game is ERPNExt being wrapped with my governance model and packaged as a direct compete against BC, Odoo, or whoever else we want to smack around :stuck_out_tongue_winking_eye: jokes people.. Jokes.. But seriously,

Who at frappe is in charge of building that Guard at the top of Frappe and bringing the development under AI guardrails? Can we chat? Does anyone wanna share their thoughts about the community and organization as a whole? Let’s build that overall agentic infrastructure for yall so that way you can be more of service to the customers and endusers and we all can elevate this market, that’s really what im trying to say here family. Sure im biased and will plug my own ideologies here, but, It’s not a matter of time before AI is writing a majority of code - that time is now. I guess im advocating for Frappe and us all to take a step back and see the successful position ERPNext is in with the rollout around the world with AI.

You are python
You are modular
You are open source
You are primed

My shameless plug - Pacioli - brings Governance and Accountability to ERPNext via the same logic that Microsoft, Google and others are already licensing and moving towards. Governance by construction is what I build aka see in my head.

I have the whole picture in my head and alot of us that use AI are bringing it into the system across different approaches. All of it is needed, do yall see it like I do?

Do you?

2

@broadway if I understand correctly you are asking about the future of contributions in the age of agentic coding / AI. The answer is we don’t know. Right now the best approach is to contribute bug reports because the fixes are the lesser problem. Maintenance is a problem too, but that needs to be handled by who ever is “owning” the downstream support to those problems (which is the Frappe team right now).

Picking genuine contributors is going to be hard. Maybe the best way is to reach out to a maintainer and pitch them personally.

3

This is the exact kind of over dramatised AI generated stuff that gets hard to understand.

4

Exactly the point I’m asking the community and Frappe as a whole and appreciate your response.

My position is from an experienced point. You named the issue of ownership downstream and that’s the exact issue I brought up about who’s at the org directing this from the top?

Hello, this is me typing these words, no AI or even spellcheck will be used so that way you see me for me. I am a retired professional in the industry that is also disabled, my brain moves faster than i can slow down sometimes and even then the words uses may not convey the correct point or hit the mark before i run into another train of thought, so i hope this all lands.

The market is primed for Frappe to take a massive jump into the ERP arena with AI. the issue, is building out the guardrails and AI infra to support the TDD, dogfooding et al. With so many opensource projects out there, this has been the biggest issue since most of these orgs are paying the burn rate by existence. Many consultants, partners et al, want the ability to have that localized ERP foundation for any and everything commercial going.

Sorry for long reply but heres the deal. To integrate AI effectively we all have to operate at the level we comprehend. I see Frappe primed to integrate their own internal models, agentic ops and the ability to basically dogfood it all while having every contributor just do the work, it either lands or it doesnt because the rails have been established.

That’s what this “AI WHATEVER” is about aka Pacioli - less of a product and more of a thesis right? I mean it does point out that the Governance I’m trying to introduce to ERPNext is the same that is being rolled around the industry via Google, Microsoft et all.

Hope this helps, and I’m willing to contribute anything that your willing to accept.

5

@broadway

This is an important discussion because the challenge is no longer simply whether AI can write ERP code. The bigger question is how we build the agentic infrastructure and guardrails around ERP systems so AI can actually operate at scale without compromising business logic, permissions, governance or stability.

This is the direction we are working on with Noviz AI.

Our open-source ERP AI Agent is an open-core, role-based agent architecture built around an LLM tool-calling core and a working ERPNext connector. The core includes module registration, entity/workflow/report factories, authentication, context assembly and the agent tool-calling loop. The architecture deliberately keeps the core ERP-agnostic, with ERP-specific capabilities implemented through connectors and configuration.

The open-source project is available here:

Noviz ERP AI Agent — GitHub

What makes this interesting for the Frappe ecosystem is the architecture rather than just the demo:

LLM → Context → Agent → Tools → ERP Connector → ERPNext → Validation / Governance

The repository currently provides a working ERPNext reference implementation, including an end-to-end quotation capability, while the architecture provides the structure for extending the same pattern across Selling, CRM, Buying, Stock, Accounting, HR, Manufacturing and Projects.

The commercial Pro layer is built on the same open core, rather than being a separate fork. It extends the ERP modules with deeper business-process logic, domain-specific rules, workflows, validations, operational capabilities and a broader MCP/tool layer. The same connector pattern is also intended to allow the architecture to extend beyond ERPNext to other ERP platforms.

We also have a live ERPNext implementation/demo, running against a real ERPNext environment, so the agent can be evaluated against actual ERP operations rather than a simulated chatbot experience.

At the platform level, Noviz AI is focused on the intelligence layer for enterprise operations: connecting agents to ERP systems, understanding business context, planning multi-step tasks, executing through authenticated identities and maintaining observability and auditability across every action. Noviz is designed to work across ERPNext, SAP, Oracle, Microsoft Dynamics 365, Odoo and other enterprise platforms.

Noviz AI — noviz.in

This is also why I think the governance discussion is so important.

AI-generated code is only one layer.

The real architecture needs:

Context + Business Rules + Permissions + Tools + Connectors + Testing + Governance + Auditability

That is how we move from an AI assistant that suggests changes to an agent that can understand, decide, execute and prove what it did.

I see a strong opportunity for the Frappe community to explore this collectively. ERPNext already provides an excellent foundation: open source, Python, modular, metadata-driven and highly extensible.

The next layer is making that foundation genuinely agent-ready and governed.

6

“The fixes are the lesser problem” is probably the key point here.

AI can make producing a patch cheap. Reviewing it, deciding whether it belongs in the project and owning it for the next few years is still expensive.

I’d rather see fewer AI-assisted PRs with a clear owner than hundreds of technically passing changes nobody wants to maintain.

7

Apologies our post was viewed as over dramatic.

no thesis this time. just your own code.

api key auth in frappe still maps the key to a user and calls frappe.set_user(user). the request then gets everything that user can do. theres no scope on the key itself, no method allowlist, no doctype limit. i checked develop, 17.0.0-dev, today. not 16. the only change on that path since 16 is the secret compare went constant-time. good fix, but thats the lock, not the scope. the scope still isnt there. its in frappe/auth.py, validate_api_key_secret.

the one seam before dispatch is auth_hooks. thats where a floor goes. close it in core at that hook, or run pacioli-guard which sits on the same hook. i dont care which. either one fixes it.

this is your ownership point, one layer down. an agent holding an api key is an unreviewed contributor with full rights and no record of what it did. the floor is how you scope that key and prove the act. same accountability you want for PRs.

no drama in that. happy to show it on your own site or point you at the lines.

still willing to contribute whatever youll take.

8

You’re right about the distinction between authentication and authorization. An API key that simply resolves to a Frappe user is not, by itself, an agent-level permission boundary.

That’s exactly why Noviz takes a different approach.

In our architecture, the agent doesn’t get a “god key” and then inherit everything that user can do. We use JWT-based authentication to establish the identity and context of the request, and the authorization layer evaluates what the agent is actually allowed to perform before the request reaches the ERP operation.

The important separation for us is:

JWT → identity/context → scoped authorization → ERPNext action → audit trail

The JWT can carry the authenticated context, while our authorization layer can constrain things such as the permitted operation, resources/DocTypes, and the scope in which the agent is acting. The agent’s identity and the originating user’s identity are also kept as part of the execution context, so an action isn’t simply recorded as “API key user did it.”

So I agree with your underlying point: authentication alone is not enough for an AI agent.

Where I would differ is that we don’t see modifying Frappe’s validate_api_key_secret as the only solution. We prefer keeping the authorization boundary in the Noviz agent layer, before the ERPNext operation is dispatched, so the agent can be constrained without turning the underlying Frappe credential into the authorization model.

That also gives us the accountability layer you’re asking for: who asked, which agent acted, what scope was granted, what operation was attempted, and what ERPNext action actually happened.

If you want to look at the implementation, happy to walk through the JWT → authorization → ERPNext flow on our side. That would probably be a more useful comparison than debating the API-key implementation in isolation.

9

In Noviz, the administrator authorization is the gateway for managing access through JWT tokens.

The admin controls which JWT tokens are issued and what role/permission scope each token receives. The agent then authenticates using that JWT, and the authorization layer validates the token and its assigned access before allowing the ERPNext operation.

So the model is:

Admin authorization → JWT token → role/permissions → authorization gateway → ERPNext action → audit

The important part is that the JWT is not automatically equivalent to the admin’s privileges. The admin decides what access that token represents.

That gives us a clear ownership point: the administrator manages the agent’s authority, while the JWT carries the authenticated access context.

Admin → User/Role & permissions → JWT credential → Noviz gateway → ERPNext

The important point is that the JWT doesn’t magically give the agent admin privileges. It represents the access that the administrator has granted to that particular user/agent.

In that sense, the agent is accessing ERPNext with the same authorization context and credentials/permissions that the user has been granted, rather than getting unrestricted access simply because it has an API key.

This is how we’re approaching the security boundary in Noviz: the administrator controls the identity, role-based access and JWT issuance, while the gateway enforces that access before allowing the agent to perform ERPNext operations.