AI agents that touch enterprise systems like SAP, NetSuite, and Salesforce are no longer just summarizing data — they're writing to the general ledger, updating vendor records, and releasing payment files without a human approving every action. This episode of DEV.co tackles the security architecture those deployments actually require, drawing from the detailed guide on securing AI agents for ERP, CRM, and financial systems. The stakes are high: a read error gives you a bad answer, but a write error gives you a misfiled journal entry, an erroneous refund, or a wire to the wrong vendor — and the auditor will want to know exactly who authorized it.

The episode walks through four layers of protection that enterprise teams can and should implement before any AI agent gets write access to a financial system:

• Identity over prompts: Every AI agent needs a scoped, lifecycle-managed non-human identity — one service account per agent per environment, with roles limited to exactly what that agent needs. The agent's identity is the real control surface, not its system prompt.
• Tool allowlists as policy: The model doesn't hold permissions — the tools do. Every write path should be a named, typed function with a server-side authorization check that runs independently of the model's decision, including amount ceilings, enumerated field values, and idempotency keys to prevent duplicate postings.
• Credential hygiene via token brokers: Long-lived API keys shared across agent runs are the first thing auditors flag. A token broker authenticates the agent, mints a short-lived, audience-scoped OAuth token for the exact action requested, and ensures the invoking human's identity is carried as a claim into the ERP's own log — meaning dual attribution survives. DEV.co's cybersecurity development services address exactly these kinds of integration-level vulnerabilities.
• SOX-compliant audit trails: Every financial posting triggered by an agent needs a structured, append-only log capturing agent identity, model version, policy version, full tool-call parameters, the authenticated human who initiated the session, and the downstream posting IDs returned by the ERP. Operational AI logs for SOX-relevant systems should be retained for at least a year.

A key theme throughout is that none of these layers require exotic technology — but most teams skip all four. The episode also highlights findings from the 2026 Verizon Data Breach report, which flagged machine accounts as the identities most likely to be abused in an agentic future, and OWASP guidance noting that a model choosing to call a tool is not the same as the user being authorized to use it. For teams building or extending these kinds of integrations, DEV.co's AI agent development services are designed to meet enterprise compliance requirements from the ground up.

Also worth a listen from the DEV.co feed: AI Has Killed White Label Web Development — What Survives explores how AI is reshaping another corner of the software industry.

DEV.co

RFP.co

The white label web development model ran on arbitrage for over a decade — domestic agencies holding the client relationship, offshore shops doing the build, and a healthy margin in between. AI has compressed that gap to near zero for commodity work, but the disruption is uneven. This episode of DEV.co unpacks which slice of the market is actually dying, why the numbers are as stark as they are, and what a viable agency playbook looks like on the other side. The analysis draws directly from the full source article on AI and white label web development.

Here's what the episode covers:

• Why the unit economics broke: AI website builders have collapsed the floor of the commodity site market — the global AI builder market hit $3.24 billion in 2026 and is projected to nearly quintuple by 2035, while Upwork's Q2 2026 data shows active clients and gross services volume both declining, with low-complexity contracts hit hardest.
• What AI builders genuinely can't do: Accessibility compliance (ARIA, focus management, landmark roles), Core Web Vitals, multi-tenant data isolation, SOC 2 scope, and anything touching a payment ledger remain out of reach for prompt-driven tools — and that's precisely where margin still lives.
• The vibe coding reality check: Tools like Lovable and Cursor have attracted hundreds of millions in funding, and productivity studies do show meaningful gains for experienced engineers on well-scoped tasks — but the same research shows no statistically significant output change at scale, and AI-generated prototypes rarely survive a serious security review.
• Selling the integration layer: The site itself is cheap now. The HubSpot-to-NetSuite sync, the custom portal behind the login, and the ingestion pipeline feeding a retrieval index are not — especially when they connect to a client's custom ERP system that no AI builder can touch.
• Replatforming the AI-built MVP: Founders who ship on Lovable over a weekend will outgrow it within a quarter. Helping them replatform without a full rewrite is a repeatable, high-value engagement — not a one-time migration — and fits naturally into software modernization service lines.
• Owning regulated, risk-bearing work: Fintech, healthcare, and anything with auditors in the room were never well served by resale shops. Named architects, signed statements of work, and client-owned code are the differentiators that AI tools can't replicate.

For a deeper dive into the technical architecture that separates durable SaaS products from AI-builder prototypes, the episode Multi-Tenant SaaS: The Full Isolation Stack Beyond the Data Model covers exactly where the complexity — and the billing — lives. More context on the source analysis is linked above.

DEV.co

RFP.co

Picking between pooled schema, schema-per-tenant, and database-per-tenant is often treated as the defining architectural decision in multi-tenant SaaS — but it's really just the starting point. This episode of DEV.co digs into the full isolation stack that has to work in concert with whatever data model you've chosen, from the moment a request hits the edge all the way through encryption, background jobs, and audit logging. The discussion is grounded in the full isolation stack for multi-tenant SaaS — a deep-dive reference covering each layer in detail.

Here's what the episode covers:

• Tenant resolution before the first query: Why isolation must be established cryptographically at the edge — via signed tokens and subdomain/hostname cross-checks — before any code touches the data layer, and why request-scoped, immutable context is non-negotiable.
• Postgres row-level security done right: How to move from "we remember to filter" to "the database enforces it for us," including the critical difference between SET LOCAL and SET in connection-pooled environments, composite index design, and when to grant bypass permissions.
• Silo vs. pool vs. bridge — mapped to deal size: A practical decision framework that ties architecture to customer tier and contract value, with a concrete rule for when to graduate tenants from pool to bridge to silo without a rewrite — made possible by abstracting the connection resolver behind a tenant router from day one. Teams building or scaling a SaaS platform will find this framing immediately applicable.
• Envelope encryption and per-tenant key hierarchies: Why a single application-wide key is a single point of total exposure, how a three-layer KMS hierarchy eliminates cross-tenant key paths, and how BYOK falls naturally out of the same architecture — making it table stakes for healthcare and financial services buyers rather than a premium feature.
• The layer most teams miss — jobs, caches, and queues: Background workers, cache entries, and message queues all carry implicit tenant context that's easy to leak; the episode addresses why these are often the last gap closed and the first place isolation breaks in production.
• Security as a structural property, not a convention: The throughline across every layer is that conventions are forgotten under deadline pressure — each mechanism discussed replaces a remembered rule with an enforced one. Teams working on cybersecurity development for SaaS products will recognize this as the right frame.

For more on securing complex financial systems at the infrastructure layer, the episode Custom Banking Software in 2026: Core APIs, KYC, and Security Controls That Actually Matter covers adjacent ground on regulated workloads and compliance-grade controls worth pairing with this one.

DEV.co

RFP.co