Originally published on integrationstars.com. n8n facts checked against n8n's blog and docs on November 9, 2026. Agents are in Preview, so details can change.
n8n Agents (announced September 25, 2026) flip the usual setup: instead of a workflow with an AI step inside it, the agent is in charge and calls your workflows as tools. For NetSuite that's a good thing, because the part that writes to the ERP stays in a workflow you built and tested.
What n8n gives you
- Workflows as tools. "Every workflow you've built in n8n is something an agent can use, and none of it needs to change." Tools can also be built-in nodes, custom JSON-schema tools or MCP servers.
- Credentials stay with the tool. "Each tool runs with the credential you attached to it. The agent never holds the keys to your instance."
- Approvals. Mark a tool as sensitive and the agent pauses for Approve or Reject.
- Memory and channels. Session memory by default, optional episodic memory (needs an OpenAI credential); Slack, Telegram, Linear and Microsoft Teams channels, schedules, or the Message an Agent node.
- History. A Sessions tab with messages, tools used and pending approvals; a version for each publish.
- Cost. One turn = one execution; tool calls to workflows don't count separately.
Availability: n8n Cloud on all plans; self-hosted on all plans from 2.32.3. Queue mode isn't supported for agents yet, and self-hosted channels need a public URL (N8N_WEBHOOK_URL).
A three-tool NetSuite design (our recommendation)
| Tool | Does | Approval | Notes |
|---|---|---|---|
| Look up customer | Open orders, unpaid invoices, credit limit | None | Fixed SuiteQL; don't let the agent write queries |
| Draft credit memo | Credit memo against one invoice | Required | Amount ≤ remaining balance; hard limit in an IF node |
| Update customer field | One allow-listed field | Required | Return old and new value for the approver |
Narrow inputs, one record type per tool, limits in the workflow rather than the prompt, and output a person can check at a glance.
Guardrails
- A NetSuite role per agent, so you can revoke one integration without touching others.
- Approval on every write until a tool has a track record; never remove it from tools that move money.
- Two audit trails: the agent's Sessions tab and NetSuite's System Notes.
- Idempotency: an agent can call the same tool twice, so check before you create.
Full guide, including setup steps and when to use the AI Agent node or MCP instead: integrationstars.com. Sources: Introducing n8n Agents, Build and manage agents.
Top comments (2)
"Each tool runs with the credential you attached to it" is the sentence I would put on a slide. The pattern I keep finding in reviews is three tools sharing one admin credential, and then the approval step in front of the agent guards nothing, because any tool can do anything. Do you scope the NetSuite user per tool, read-only for the search tool and write only for the update one? That is the setup that survives an audit, and it also limits the blast radius of a prompt injection.
Agreed. That sentence only means something if the credentials are actually different. Three tools sharing one admin credential turn the approval step into theater.
Yes, one integration role and one credential per tool:
Lookup tool: a role with View on customers and transactions plus the web services permission, nothing else. A prompt injection in a memo field can make it read more, but it can't write anything.
Credit memo tool: Create on credit memos only, behind approval.
Field update tool: Edit on customers only, behind approval.
One limit worth knowing: NetSuite roles control access by record type and level (View, Create, Edit, Full), not by individual field. So the "only these fields" rule still has to live in the workflow, as an allow-list checked before the write, not in the role. The amount cap on credit memos is the same: an IF node in the workflow, not a permission.
Two side benefits of splitting credentials. System Notes then show which tool made each change, not just "the integration user". And you can revoke the write tool's access without breaking lookups.
On the n8n side, also keep the write credentials out of reach of anyone who can edit the agent. Otherwise someone can attach the write credential to a new "lookup" tool, and the separation is gone.
In the article we wrote "a NetSuite role per agent". Your version, a role per tool, is the better rule.