At its AI World conference in Las Vegas on October 26, 2026, Oracle announced an AI layer that decides which approval a request needs. Oracle Fusion Companion “automatically selects and coordinates the appropriate transactions, workflows, approvals, AI agents, and agentic applications,” according to the company’s announcement. The same release says users “no longer need to know” which workflow or approval to initiate. For a finance or HR team, that moves a routine judgment from the employee to the software: which approval path a piece of work takes.
Basil C. Puglisi has argued that this decision should never pass to the system being governed. In September 2026 he published his public comment on ISO/DIS 21520, a draft ISO standard for project managers working with AI. His proposed definition of AI Governance gives named humans binding power to accept, modify or reject AI outputs at defined checkpoints, “with authority that cannot be delegated to the AI system being governed.” The same comment says that, for automated work, “the checkpoint moves upstream, where the named human signs the policy that authorizes automated action.” Oracle’s release describes software that selects the approval, and that makes the signed policy upstream the control a client actually owns.
Oracle and NetSuite put agents in charge of routing enterprise work
Oracle made two related announcements the same day, and the first, Fusion Companion, works through outside AI tools such as ChatGPT. Fusion Agentic Home is the native experience inside Fusion Applications, where employees state an objective, delegate it and track its progress. A companion release on outcome-driven AI across Fusion Applications introduced 25 Agentic Applications built on a new runtime called Fusion Claw, now available across ERP, HCM, supply chain and customer experience. Oracle calls the result “a system of outcomes, where people define the objectives, authority, and accountability and the Agentic Applications coordinate the process to get to an outcome.”
A finance team reading the individual application descriptions finds review language throughout. Ledger investigates accounting exceptions and applies computation “that is approved and authorized, within organizational policies and controls.” Payroll Activity Workspace prepares recommended follow-up actions “for review and approval,” and the CPQ migration application executes approved steps “within provided authority.” NetSuite announced SuiteAgents at SuiteWorld the same day, with agents for software, product and construction companies available now in NetSuite Next, operating “within NetSuite’s established governance models.” Both companies place the agent inside the customer’s existing approval rules and leave the customer to supply those rules.
Most approval rules were written for people who already knew them
An approval policy in most mid-size companies is partly a document and partly habit. The delegation-of-authority matrix might say a regional controller signs off on vendor payments up to a set amount. The team also knows that any payment to a brand-new vendor goes to the CFO regardless of size. When an employee picks the workflow, that unwritten rule gets applied because the employee knows it. When Fusion Companion picks the workflow, it can’t apply a rule that nobody configured.
The Oracle releases reviewed here don’t say how Companion chooses between two plausible approval paths, or how a customer reviews the choice it made for a given request. The releases promise work inside “established identity, permissions, policies, and approval controls.” That promise is only as complete as the controls a customer has written down. Whatever sits between the written matrix and the team’s habits is where the agent ends up working without a rule.
Responsible AI controls and AI Governance checkpoints do different jobs here
Puglisi draws a line between two layers in this kind of deployment. Permissions and policy checks that run automatically are machine checking machine with no human review, which he classifies as Responsible AI. Oracle’s identity and permission controls belong in that layer, and clients should keep them switched on. The choice of which human approves which class of work belongs to AI Governance. Under his Checkpoint-Based Governance, a named person accepts, modifies or rejects at a defined point, and the decision is recorded.
His ISO comment adds a requirement that matters for an orchestration layer: AI cannot satisfy, close or validate a checkpoint for another AI. An agentic application that routed its own output to a reviewer it selected, under a rule it inferred, would come close to that line. The fix sits upstream, in the policy a named person signs before Companion ever runs.
How Puglisi would prepare a Fusion or NetSuite client before switching routing on
The first step is to write the approval map as rules a system can read. The team lists each class of work the client plans to delegate, such as vendor payments, payroll corrections, workforce actions and configuration changes. For each one it records who approves, up to what limit and with what exceptions. The unwritten rules go on the page as well, starting with the ones a long-tenured manager would mention without being asked.
A named executive then signs that map as the policy authorizing automated routing, and the signature carries a review date. When the business changes a limit or adds a new vendor category, the map changes first and the agent configuration follows.
The third step is a sample. Each week, a reviewer pulls a random set of requests that Companion or a SuiteAgent routed and compares the approval path it chose with the signed map. Mismatches go back to the map owner, who decides whether the map was incomplete or the routing was wrong. In B2B finance, that sample should weight payments and contract changes. For a nonprofit waiting on the nonprofit SuiteAgent, which NetSuite lists as planned for a future release, it should weight restricted-fund decisions, where a wrong approver can create a compliance finding.
A client can track progress with a pair of numbers. The first is the route match rate, the share of sampled requests where the approval path matched the signed map, with a target the client sets before rollout and reviews monthly. The second is the share of delegated work classes covered by a signed, dated map entry, which should reach every class before routing goes live for it. Oracle’s outcome-driven AI release says AI Agent Studio includes “built-in observability, ROI measurement, and safety controls,” and a client can ask whether those tools report which approval path each request took.
Routing visibility is the detail to watch at AI World
The open question is visibility. If Oracle shows customers, request by request, which approval Companion selected and which rule it applied, a weekly sample is a short exercise. If that record is hard to pull, clients will have to build it themselves before they can audit anything. Watch the AI World sessions and the first customer reports for that detail, and ask for it in any Fusion or NetSuite agent pilot this quarter. The answer decides whether a client can show an auditor who approved the payment and under what written rule.
Sources
- Oracle. (2026, October 26). Oracle introduces new AI-powered ways to execute work across Oracle Fusion Applications [Press release]. https://www.oracle.com/news/announcement/ai-world-oracle-introduces-new-ai-powered-ways-to-execute-work-across-oracle-fusion-applications-2026-10-26/
- Oracle. (2026, October 26). Oracle advances outcome-driven AI across Fusion Applications [Press release]. https://www.oracle.com/news/announcement/ai-world-oracle-advances-outcome-driven-ai-across-fusion-applications-2026-10-26/
- Oracle NetSuite. (2026, October 26). NetSuite puts industry expertise to work with new AI agents [Press release]. PR Newswire. https://www.prnewswire.com/news-releases/netsuite-puts-industry-expertise-to-work-with-new-ai-agents-302919134.html
- Puglisi, B. C. (2026, September 15). Public technical comment on ISO/DIS 21520, Clause 3.2: Defining AI governance by decision authority. basilpuglisi.com. https://basilpuglisi.com/iso-21520-ai-governance-comment/
Questions readers ask
What is Oracle Fusion Companion?
Oracle Fusion Companion, announced October 26, 2026, is an AI layer for Oracle Fusion Cloud Applications. It reads a user’s objective and automatically selects and coordinates the transactions, workflows, approvals and AI agents needed to complete the work, through tools such as ChatGPT or through the native Fusion Agentic Home experience.
What are Oracle Fusion Agentic Applications powered by Fusion Claw?
They are 25 outcome-based applications across ERP, HCM, supply chain and customer experience, built on a runtime Oracle calls Fusion Claw. Examples include Ledger for accounting exceptions and Payroll Activity Workspace, and Oracle says people define the objectives, authority and accountability while the applications coordinate the process.
Why does it matter when an AI agent selects the approval workflow?
Approval rules in many companies are partly written and partly habit. When an employee picks the workflow, unwritten exceptions still get applied, but an agent can apply only the rules that were configured. A missing rule means work can reach the wrong approver even though every system permission checked out.
What is a signed approval map for agentic workflows?
It is a written record, for each class of delegated work, of who approves, up to what limit and with what exceptions. A named executive signs it as the policy that authorizes automated routing, which places the Checkpoint-Based Governance decision upstream of the agent.
How can a company measure whether agent approval routing is working?
Track the route match rate, the share of randomly sampled agent-routed requests whose approval path matched the signed map. Then track the share of delegated work classes covered by a signed, dated map entry, which should reach every class before routing goes live for that class.
#AIg
Leave a Reply