If an AI agent has written bad data to NetSuite, work in three steps: stop it, find what changed, then undo it. Stop it by cutting the agent's access at the point it connects: remove the MCP Server Connection permission from its role or disable its integration record if it uses NetSuite's AI Connector, revoke the OAuth 2.0 authorized application, or turn off the Celigo flow or token it runs through. Then pull the evidence while it still exists. The AI Connector's Execution Log is kept for only 21 days in production, and System Notes plus a Deleted Record search show what was created, changed or deleted, by whom and from where. Undo the damage with reviewed corrections, not a hurried mass delete. The rest of this guide gives the exact NetSuite paths, from Oracle's documentation, and the runbook to have ready before you need it.
At a glance
- Stop: remove the MCP Server Connection permission from the agent's role, revoke its OAuth 2.0 authorized application (this invalidates all its tokens), block its integration record, or disable the Celigo flow or token it uses.
- Find: the AI Connector integration record's Execution Log (21 days in production, 7 in sandbox), a System Note saved search filtered by user, role and date, and a Deleted Record search.
- Undo: restore field values from the old values in System Notes, reverse transactions the way your finance team would for any posting error, and re-open access on a narrower role.
- Prepare: Oracle's own guidance is to document how to disable MCP access and revoke AI agent consent quickly, before an incident.
Step 1: Stop the AI agent writing to NetSuite
NetSuite has more than one way in, so the switch depends on how the agent connects. Find out first; the agent's owner, or the integration records under Setup > Integration > Manage Integrations, will tell you.
| How the agent connects | Fastest way to stop it | What to know |
|---|---|---|
| NetSuite AI Connector Service (NetSuite's own MCP server) | Remove the MCP Server Connection permission from the role it uses (Setup > Users/Roles > Manage Roles), or disable the connector's integration record | MCP tools run with the permissions of the NetSuite user behind the agent, so cutting the role cuts the agent. An enabled AI Connector integration record can't go back to pending, only be disabled. |
| Any app using OAuth 2.0 (custom agents, many connectors) | Setup > Users/Roles > OAuth 2.0 Authorized Applications: click the link in the Created column, then Revoke | Revoking "invalidates all tokens associated with that application". The record stays for auditing, and the user must consent again to reconnect. |
| An integration record with its own consumer key (token-based or OAuth) | Open the record under Setup > Integration > Manage Integrations, set State to Blocked, save | Oracle notes that blocking doesn't stop an application that already has an existing session, or one calling RESTlets with NLAuth. Revoke tokens as well. |
| Through Celigo (a flow, or Celigo Platform MCP) | Disable the flow in integrator.io, or revoke the API token the agent uses | For an agent operating Celigo itself, see our Celigo Platform MCP and CLI guide. Writes it already sent to NetSuite still need the steps below. |
Do this first, even if you are not yet sure the agent is at fault. Pausing an agent costs you a few hours of automation; letting a looping agent keep posting can cost you a month-end close. Tell the people who use it, so nobody re-authorizes it to "fix" the outage.
Step 2: Find what the AI agent changed in NetSuite
Pull the evidence before you change anything else, because some of it expires.
- The AI Connector's Execution Log, first. Oracle's FAQ says you can open the Execution Log of the integration record to see request time, duration, status, user, HTTP response and request details, with the HTTP method and URL path. Retention is 21 days in production and 7 days in sandbox, so export it now. Oracle's risk guidance also says "all usage of MCP tools is logged".
- A System Note saved search. Go to Reports > New Search > System Note and filter by the user or role the agent ran as and the time window. Return the date, record type, record, field, old value and new value. Run it with an administrator role: non-admin users only see system notes they authored, so their results are incomplete.
- System Notes v2, where your record types support it. It records who made the change, their role, "the interface from which the change was initiated", the action and the object, with old and new values. It also keeps deleted records, shown with a Delete action.
- A Deleted Record search for the rest. Classic System Notes don't keep deleted records. Reports > New Search > Deleted Record shows when each record was deleted, by whom, in what context, its type and name. Only administrators can use it by default.
- The other side's logs. If the agent worked through Celigo, Celigo's audit log can be filtered by source, including
mcp, and flow run history shows what each run sent. Oracle recommends reviewing NetSuite MCP logs together with the logs of the external AI agent and MCP servers.
Save the searches and exports somewhere outside NetSuite, and write down the time window you are confident covers the incident. That list of records is what you will correct.
Step 3: Undo the damage
This is our recommendation from integration clean-ups, not an Oracle procedure. The aim is a correct ledger and an audit trail that explains itself, not a NetSuite that looks as if nothing happened.
- Sort the changes by risk. Field edits on master data (customers, items, vendors) are usually simple to restore. Created transactions are next. Posted transactions, approvals, payments and anything in a closed period come last, with your finance team involved.
- Restore field values from the old values. Your System Notes export already has the old value for each changed field. Use it as the source for a CSV import update or a reviewed integration run, test it on a few records first, and keep the file.
- Reverse transactions the normal way. Treat agent-created transactions like any other posting error: correct them the way your finance team would for a person's mistake, so the reversal is visible in the audit trail. Avoid a hurried mass delete; deletions are the hardest changes to explain later.
- Check what flowed downstream. Integrations may already have copied the bad data to Shopify, Salesforce, a 3PL or a bank file. Check those flows' run history for the same window.
- Re-open access narrower than before. A new, smaller role, an approval step on the action that went wrong, and a separate token so the agent's changes stay easy to find.
Before it happens: an AI agent runbook for NetSuite
Oracle's guidance for the AI Connector says to "document procedures for quickly disabling MCP access, removing MCP permissions, revoking AI agent consent, disabling specific MCP tools, or suspending access to third-party MCP servers when necessary". In practice that means:
- Write down the switches. For each agent: how it connects, which role and integration record it uses, who can revoke it, and who must be told.
- Give each agent its own role. Oracle recommends separate roles for different MCP tools instead of reusing broad operational roles. The AI Connector already refuses Administrator and full-permission roles.
- Gate the high-impact actions. Oracle names creating, modifying, deleting, approving, paying, exporting large data sets and changing permissions as high-impact. Put a person in front of the ones that touch money or the ledger, as in the propose, validate, approve, execute pattern from our system of action article.
- Save the searches now. A System Note search and a Deleted Record search filtered on the agent's role, ready to run, save the first hour of an incident.
- Export the Execution Log on a schedule. With 21 days of retention, a problem found at month end may already be partly gone.
- Review access regularly. Oracle suggests periodically reviewing users with MCP permission, roles, installed tools, authorized agents and active consent grants, and removing what isn't needed.
For the wider governance picture, see AI agent governance and Celigo MCP Server security. For duplicate writes caused by retries and parallel runs, the fixes in our n8n race conditions article apply to any platform. And for how NetSuite's own AI Connector compares with Celigo and n8n, see NetSuite MCP: AI Connector vs Celigo vs n8n.
Frequently Asked Questions
How do I stop an AI agent from writing to NetSuite right now? Cut its access where it connects: remove the MCP Server Connection permission from its role if it uses NetSuite's AI Connector, revoke its app under Setup > Users/Roles > OAuth 2.0 Authorized Applications, block its integration record, or disable the Celigo flow or token it uses.
How can I see what an AI agent changed in NetSuite? Export the Execution Log on the AI Connector's integration record, then run a System Note saved search filtered by the agent's user or role and the time window, as an administrator. Use a Deleted Record search for deletions, or System Notes v2 where your record types support it.
How long does NetSuite keep AI Connector logs? Oracle's FAQ gives the Execution Log retention as 21 days for production and 7 days for sandbox, so export it as soon as you suspect a problem.
Does blocking the integration record stop the agent immediately? Not always. Oracle notes that blocking doesn't affect an application that already has an existing session, or RESTlet calls using NLAuth. Revoke the OAuth 2.0 authorization or the tokens as well.
Can the NetSuite AI Connector run as an Administrator? No. Oracle says the AI Connector Service can't be used when logged in with the Administrator role or roles with full permissions, and MCP tools run with the permissions of the user behind the agent.
Should I delete the records the agent created? Usually not in a hurry. Correct or reverse them the way your finance team handles any posting error, so the audit trail shows what happened and how it was fixed.
Entech Solutions builds and supports NetSuite integrations on Celigo and n8n, including AI-agent access with scoped roles, approval steps and logging. If an agent has already written something it shouldn't, or you want the runbook in place before it does, talk to us.
Sources, checked November 5, 2026 (Oracle NetSuite Help Center): Associated Risks, Controls, and Mitigation Strategies; NetSuite AI Connector Service FAQ; Required Features and Permissions; Viewing and Revoking OAuth 2.0 Authorized Applications; Blocking an Application; Searching System Notes; System Notes and System Notes v2; Searching Deleted Records. Celigo audit log: Platform MCP tools.