How to run AI on your own infrastructure and still reach your ERP

Traffic crosses a border without stopping when the groundwork is done in advance. A road leads to the crossing, the papers are in order and the checkpoint knows what may pass. Leave one out and the queue starts forming.

Data moving from your ERP to an AI model crosses a border of its own, the edge of your network. The road is the connection between the two systems. The papers are the identity of whoever is calling and the policy that says what they may take. The checkpoint is the tool, which decides what leaves and logs that it did. Put all three in place before the AI needs the data and the call goes through when it is made. If the model runs inside your own network, there is no border to cross at all.

Data control and its four decisions

Where a vendor’s servers sit is the most visible part of data control. For AI, it is one input among several. Four decisions determine how your data moves: where the integration logic runs, what the model is shown, where the model itself runs and what gets recorded about each call.

Public-sector bodies, utilities and other critical infrastructure operators need all four settled before a pilot reaches production. The sections below take them in that order.

Keep the logic inside your walls

In Frends, an Agent is the runtime that executes your Processes, and it can run on your own infrastructure. A Process built with an MCP Trigger becomes a tool an AI client can call. The Process, and its connection to the ERP behind it, run on the Agent in your environment.

The Agent connects to the Frends Tenant over a message bus using outbound-only connections, so the link needs no inbound connection from the Tenant to your network.

Decide what the model sees

The boundary between the model and your business system is the tool. A Process decides what a tool returns. Join, filter and business logic run inside the Process, so the model receives the answer to the question it asked and not the full record behind it. Data masking and per-identity access controls apply at the same layer. A tool that returns an invoice total and a vendor ID exposes less than one that returns the complete vendor master record, and you choose which one to build.

API Policies decide who can reach each tool from outside. No policy means no access.

Run the model where you run everything else

Some organizations accept a cloud AI client calling governed tools. Others need the model inside the perimeter too. Frends supports both.

For the second case, the AI Connector, the Process step that calls a model, can point at an on-premises Ollama service. Run that next to a self-hosted Agent and the AI inference and the MCP tool calls stay inside your network. The only requirement is that the Ollama service is reachable from the Agent over your internal network. The AI Connector is model-agnostic and can also use Frends-hosted AI, Azure AI Inference or other compatible APIs, so the choice stays with you.

Record every call

Every tool call maps to a Process instance, which you can inspect shape by shape in the Control Panel, from the request to the response. That record is what an auditor will ask for.

The State of Integration & AI 2026 report shows how far most organizations are from it. 64% of leaders rate centralized governance tooling as critically or very important. Only 12% treat integration as the governance and control layer.

What to take to your next architecture review:

• Where does each Process run?

• What does each tool return, and who can call it?

• Where does the model run?

• Where is the record of every call kept?

• Ask the same questions of every vendor, including us.

At Gartner IT Symposium/Xpo in Barcelona, the Frends team will take you through all of that and more.

Don't miss our CTO Asmo Urpilainen on Nov. 11 at 3 p.m. as he builds governed AI access to a real ERP live on stage.