SBC ERP: AI-Native Platform

01

Why SBC ERP

Most organisations in the region run on a patchwork: an accounting package, spreadsheets for budgets and AFEs, email for approvals, a separate system for operations, and reports assembled by hand at month end. Each part works on its own, but the business runs in the gaps between them, where data is re-keyed, approvals stall and nobody sees the whole picture until it is too late to act.

Large international ERP suites close some of those gaps, but at a cost: long implementations, heavy customisation that makes every upgrade a project, and AI that is bolted on outside the system, often in a foreign cloud. Industry processes such as joint-venture accounting, EPSA cost recovery, cargo release or Oman e-invoicing are left to add-ons and consultants.

SBC ERP was designed from the start to remove that trade-off. A compact, stable Core holds what every process needs; industry logic lives in modules that can be added and upgraded independently; every module speaks MCP, so AI can work across the whole enterprise under the same permissions and approvals as people; and the platform is built and supported in Oman, in Arabic and English.

The challenge

Data is entered several times in disconnected systems, and month-end is spent reconciling them instead of analysing the business.
Approvals travel by email and paper, so nobody can see where a request is, and the Delegation of Authority is enforced by memory.
Spend is discovered after it is committed: budgets and AFEs are checked in spreadsheets, if at all.
Joint-venture, cost-recovery and job-costing requirements are handled outside the ERP, with manual allocation and high audit risk.
Customisations make every upgrade expensive and risky, so systems fall years behind.
AI tools sit outside the system of record, cannot be trusted with permissions, and often send sensitive data abroad.

Design principles

Six principles guide every decision in the platform, from the data model to the way AI is allowed to act.

Clean Core

The Core holds only shared services. Industry and customer logic lives in modules, so the Core can be upgraded without breaking anything built on it.

Composable by protocol

Modules declare their data, actions and rules through MCP. They join and leave the platform without point-to-point integrations.

AI as a governed user

AI acts through the same permissions, approvals and audit trail as a person. It can never do more than the user it works for.

Configuration over code

Workflows, approval routes, forms, reports and KPIs are configured by the business, not developed and redeployed.

Secure and sovereign

Zero-trust controls on every request, and the option to keep data, search and AI models entirely in your environment or in Oman.

One record, live

Every module writes to one platform, so a transaction captured once is immediately visible in finance, operations and management reporting.

Business outcomes

Technology only matters for what it changes in the business. These are the outcomes SBC ERP is designed to deliver for each group in the organisation. Measurable targets are agreed in the discovery phase of each implementation and tracked in the KPI module after go-live.

Board & CEO

One live view of performance, spend and risk across companies and blocks, with every figure traceable to its source.

Finance

Faster close, commitments visible before they become invoices, automatic partner allocation and cost recovery, and fewer reconciliations.

Operations

Requests approved in hours instead of days, spares and services available when needed, and planned rather than emergency maintenance.

Procurement

Policy enforced on every purchase, transparent tenders, contract rates honoured and supplier performance measured.

Logistics

Margin known per job before it closes, exceptions handled as they happen and cargo released only under control.

Real estate & construction

Every project measured against its BOQ, payments certified on real progress, and every unit tracked from reservation to handover.

People & HR

Self-service for employees and managers, correct payroll and leave, and approvals that follow the organisation chart automatically.

IT & security

One platform instead of many, upgrades without re-implementation, and security and audit enforced by design.

Auditors, partners & regulators

Complete, tamper-evident trails, partner statements on demand, and statutory, EPSA and e-invoicing reporting from the same data.

02

The Core & AI

SBC ERP is built on a clean-core principle. The Core is a compact, stable platform that provides the services every business process depends on: identity and access, organisational master data, documents, workflow and approvals, tasks, scheduling, notifications, audit and search. Industry logic never lives in the Core. It lives in modules, which is what keeps the platform upgradeable, predictable and fast to extend.

Every module connects to the Core through the Model Context Protocol (MCP), an open standard for exposing data and actions to AI. Through MCP each module declares its data, its business actions and the rules that govern them. The result is a composable enterprise: modules can be added, upgraded or retired independently, without custom integration and without touching the Core.

Because every module speaks the same protocol, AI is not an add-on; it is part of the architecture. The Core’s AI engine knows which modules are installed, reasons across their data, and orchestrates multi-step work that spans finance, supply chain, people and operations. It acts only within the user’s permissions, and every consequential action passes through the same approval framework as a human-initiated transaction.

Business modules
Oil & Gas modules
Logistics modules

MCP

SBC CoreAI engine

How it works

Anatomy of an AI-assisted transaction

Intent expressed
User
A field engineer writes in AI Chat: “Raise a purchase order for 20 pump seals for Block 5.”
Identity and authority resolved
Core
The Core authenticates the user and resolves their company, role, permissions and approval limits.
Work planned across modules
AI
The AI engine interprets the request and discovers over MCP the modules that can fulfil it: Inventory, Budget and Procurement.
Modules execute
Module
Inventory confirms stock is short, Budget confirms funds against the AFE, and Procurement prepares a draft purchase order.
Approval under Delegation of Authority
Control
The draft is routed to the approvers defined for its value and category. Nothing is committed without human approval.
Committed, audited, notified
Core
The approved order is posted, every step is written to the audit trail, and stakeholders are notified.

ResultOne sentence becomes a compliant, fully audited transaction across three modules, in minutes rather than days.

Identity & access

Users, roles, organisational units and tenants, governed by least-privilege access, segregation of duties and record-level security.

Workflow & approvals

Visual process design with multi-level, conditional approvals and escalation, enforcing your Delegation of Authority in every module.

Organisation master data

A single source of truth for legal entities, branches, banks, branding and report letterheads.

Documents & requests

Governed document management and a unified Request Center, shared by every module.

Tasks & scheduling

Tasks, calendars, reminders and notifications that keep people and processes on schedule.

Audit & enterprise search

An immutable record of every sensitive action, and one search across the entire enterprise.

Embedded AI, governed by design

AI Chat answers business questions from live, authorised ERP data, in Arabic and English.
AI Agents execute approved processes end to end, from preparing documents to routing approvals and following up.
AI-assisted search and analytics turn questions into reports, dashboards and management insight.
The AI inherits the user’s permissions exactly: it sees only what the user may see and does only what the user may do.
Sensitive actions always require human approval, and every AI action is recorded in the audit trail.
Powered by SBC’s in-house AI engine, so enterprise data remains within your controlled environment.

How MCP connects modules and AI

In most ERP systems, modules are joined by custom integrations, and AI is bolted on through reports or exports. In SBC ERP every module publishes its capabilities through the Model Context Protocol: the data it holds, as resources; the business actions it can perform, as tools; and the rules that govern them, such as required fields, approval thresholds and segregation of duties. The Core keeps a live registry of what every installed module offers.

When a user asks AI Chat for something, the AI engine reads that registry, plans the work, and calls the tools it needs, always with the user’s own identity and permissions. Each call is validated by the module that owns the data, exactly as if the user had clicked the button themselves. Actions that change money, stock or commitments stop at the approval step defined in your Delegation of Authority, and every call, input and result is written to the audit trail.

AI agent over MCP · demoLIVE

One sentence, four modules, one approved order

The AI engine discovers what each module can do through MCP, calls them with the user’s permissions, and waits for the approval your Delegation of Authority requires.

1
UserRequest in plain language
“Raise a PO for 20 pump seals for Block 5.” The AI engine resolves the user’s role and limits first.
2
Inventoryinventory.check_stock
4 in stock · 20 needed.
3
Budgetbudget.check_afe
AFE-2207 · OMR 112,500 free.
4
Procurementprocurement.draft_po
PO-10482 · OMR 18,250.
5
Approvalsapprovals.route
Ops Manager approved.
6
SBC CoreCommitted and audited
The approved order is posted and every tool call is written to the audit trail.

MCP tool call
Result
Human approval
SBC Core

Why this architecture matters

New modules become available to AI the moment they are installed, without new integrations.
The AI can never do more than the user could do; permissions are enforced by the modules themselves.
Every AI action is reproducible and auditable, step by step, like any human transaction.
Third-party systems can join the same way, by exposing an MCP server for their data and actions.

Intelligence in every module

AI in SBC ERP is not a separate product. Four capabilities run across every module, on your own infrastructure if you choose: a search engine that understands meaning, local AI connected to every module through MCP, a decision engine that prepares every approval, and a report builder that turns questions into reports.

Intelligent & semantic search

Enterprise search usually means typing the exact invoice number or customer name. SBC ERP search understands what you mean. Names, amounts, dates and statuses in a question become precise filters, and descriptions are matched by meaning, so “pumps that keep failing” finds work orders about seal leaks and trips even when those words never appear.

One index covers records, documents, emails and conversations from every module, in Arabic and English. Every result is filtered by the user’s permissions before it is shown, and every hit links straight to the record, its history and its related documents.

Natural-language filters

Supplier, amount, period, status and location understood in plain Arabic or English.

Meaning, not keywords

Vector search finds related records and documents even when the wording is different.

Across every module

Finance, procurement, assets, HR, projects, logistics and documents in one place.

Permission-aware

Users only ever see results they are allowed to open, including inside documents.

Intelligent search · demoLIVE

Ask in your own words, in Arabic or English

One search across every module. It understands names, amounts and dates as filters, finds records by meaning rather than exact words, and only ever shows what the user may see.

Your permissions

Local AI for every module, through MCP

Every SBC ERP module ships with its own MCP server, which exposes its data, its business actions and its rules in a standard way. That makes any compatible AI model a first-class user of the ERP, under the same permissions and controls as a person.

Organisations that cannot send data outside their walls can run open-weight language and embedding models on their own servers or in an in-country cloud. The AI engine, the search index and the models all stay inside your environment, while still reaching every module. You choose the model; you can change it later without changing the ERP.

Not every task needs the largest model. The AI engine routes each request to the model that fits it: a small, fast model to classify an invoice line, a multilingual embedding model to index documents for search, a model tuned for Arabic writing to draft letters, and a larger reasoning model to compare tenders or explain a variance. That keeps answers fast and hardware requirements realistic.

Local AI · demoLIVE

The right model for each task, and no data leaves

Modules ask the AI engine for help over MCP. The engine chooses the model that fits the task, from a small classifier to a large reasoning model, and runs it on your servers or in an in-country cloud.

Your environment · on-premise or in-country cloud

Requests from modules

AccountingCode supplier invoice INV-88213GL 5120 · Maintenance spares · 98% confidence
SearchIndex 1,240 new documents1,240 documents embedded in the local index
HRDraft an offer letter in ArabicDraft ready for HR review · letterhead applied
ProcurementCompare 3 bids for tender T-114Evaluation summary with 2 clarifications

AI engineModel router

Permissions
MCP tools
Audit

Open-weight models

ClassifierSmall · fast
EmbeddingsMultilingual
Arabic writerMedium
ReasoningLarge

Public AI services & internet

Data sent outside: 0 bytes
AI calls audited: 0

Inside your boundary
Request routed
Model running
No external calls

An MCP server in every module: data as resources, actions as tools, rules enforced by the module itself.
Local models on-premise or in Oman, with no data leaving your environment.
Model choice per task, from small fast models for classification to larger models for reasoning and Arabic writing.
One permission model for people and AI, and one audit trail for both.

AI decision engine for approvals

Approvers are the bottleneck of every organisation: they receive dozens of requests a day, each needing context that lives in several modules. The decision engine prepares that context before the request reaches them. It checks the budget or AFE, compares prices with history and contracts, reviews the supplier’s performance and compliance, confirms the approver’s authority and looks for patterns such as orders split to avoid a tender.

The result is a short, evidence-based summary with a risk level and a recommendation. Routine requests can be approved in seconds with confidence; unusual ones stand out immediately. The decision always remains with the manager, and the analysis is saved with the approval in the audit trail.

AI decision engine · demoLIVE

Every approval arrives with its evidence

Managers approve dozens of requests a day. The decision engine checks each one against budget, history, policy and patterns, explains what it found and recommends, while the decision stays with the manager.

Approval requestPO-10511 · Mechanical seals & bearings

Amount: OMR 46,800
Supplier: Al Noor Trading LLC
Charged to: AFE-2207 · Block 5
Requested by: Maintenance planner

ApproveAsk a questionReject

✓ Approved by you · reasons and AI analysis saved to the audit trail

AI analysis– risk

BudgetWithin AFE-2207 · OMR 65,700 remaining after this order
Price+1.2% vs the last 6 orders · within contract rates
Supplier97% on time · no open quality issues · VAT number valid
AuthorityWithin your approval limit of OMR 50,000
Pattern2 similar orders this week just under the tender threshold

Recommendation

Approve. Ask Procurement to consolidate future seal orders into one tender to stay within policy.

Check passed
Worth a look
AI recommendation

Dynamic report builder

Every module comes with standard reports, but the questions managers actually ask change every week. The report builder lets anyone describe a report in plain language, or assemble it visually, from any combination of modules: measures, dimensions, filters, periods and comparisons.

The builder shows the definition it understood before it runs, so numbers are never a black box. Reports refresh from live data, drill down to transactions, respect each reader’s permissions, export to PDF and Excel, and can be scheduled or shared with partners. Statutory and industry formats, such as IFRS statements and EPSA cost-recovery reports, are built in.

Report builder · demoLIVE

Describe the report. It builds itself.

The report builder works across every module. Describe what you need, check the definition it proposes, then save, schedule or share it, with every figure drilling down to its transactions.

MeasuresActual cost · BudgetByAFE · Partner sharePeriodQ3 2026SourcesAccounting · Budget · Block

AFE	Budget	Actual	Partner A 60%	Partner B 40%
AFE-2207 · Drilling	525k	431k	258.6k	172.4k
AFE-2214 · Workover	180k	192k	115.2k	76.8k
AFE-2230 · Facilities	320k	214k	128.4k	85.6k

✓ Saved as “Q3 AFE cost review”Every Monday 07:00Shared with JV partners · PDF & Excel

Budget
Actual
Over budget

Responsible AI & governance

AI that can act inside an ERP must be governed as carefully as any employee with system access. SBC ERP treats every AI model and agent as a user: it is identified, it is given exactly the permissions of the person it works for, its actions pass the same approvals, and everything it reads, proposes and does is recorded.

Administrators decide which modules and actions AI may use, which tasks may run unattended and which always require a person, and which model serves each task. AI output is always shown with its sources, so a user can check where a figure or recommendation came from before relying on it.

Same permissions as the user

AI inherits the user’s role, data scope and field restrictions. It cannot see or change anything the user could not.

Human in the loop

Actions that commit money, stock, people or contracts always stop for a human decision under the Delegation of Authority.

Explainable results

Answers, summaries and recommendations link back to the records, documents and rules they were based on.

Policy per module and action

Administrators enable AI per module and per tool, set which steps may run unattended and review usage.

Complete AI audit trail

Prompts, tool calls, inputs, results and the human decision are logged together and can be replayed.

Aligned with recognised frameworks

Controls are designed around ISO/IEC 42001, the NIST AI Risk Management Framework and the OWASP guidance for LLM applications.

03

Dynamic workflows

Every business process in SBC ERP runs on one dynamic workflow engine in the Core. Purchase requests, AFEs, invoices, rate exceptions, cargo releases, contracts, leave and onboarding all use the same engine, so approvals, deadlines, notifications and audit behave identically everywhere.

Workflows are configuration, not code. Process owners design them visually, and every route is decided at run time from live data: the amount, the cost centre, the requester’s position and grade, the Delegation of Authority, the partner’s share or the customer’s credit status. When the organisation changes, the workflow changes the same day, without a software release.

Because modules connect to the Core through MCP, a single workflow can span the whole enterprise. One approval can reserve budget, create a purchase order, notify a supplier, update the ledger and ask an AI agent to prepare the next document, with every step recorded in one audit trail.

Visual process designer

Design steps, decisions, parallel branches and deadlines on a canvas, then publish a new version without redeploying anything.

Event triggers from any module

Start a workflow when a record is created, a value changes, a date arrives or an external system calls a webhook.

Dynamic routing by DOA

Approvers are resolved at run time from positions, grades, amounts and the Delegation of Authority, never hard-coded to people.

Sequential & parallel approvals

Chain approvers, run reviews in parallel, require all or any, and delegate while someone is away.

SLAs, reminders & escalation

Every task carries a deadline; reminders and escalation to a deputy or the next level happen automatically.

Cross-module actions via MCP

A step can create or update records in any module, such as budget, procurement, finance, HR or logistics, in the same transaction.

AI-assisted steps

AI agents can pre-check requests, summarise context for approvers and draft documents, while the decision stays with a person.

Versioning, simulation & audit

Test a new version on sample data before publishing; running cases keep their version, and every action is logged.

Live workflow · demo

Leave request, routed dynamically

One instance travelling through the process. Routing, approvers and deadlines come from configuration, not code.

1
EmployeeLeave needed
2
EmployeeSubmit requestDates · type · cover
3
SBC ERPValidateBalance · policy
4
Line managerManager approvalSLA 48h48h without action → escalates to a deputy · Rejected → returned with reason
5
SBC ERPOver 3 days?Yes → HR approval · No → straight to Update records
6
HRHR approvalPer DOA
7
SBC ERPUpdate recordsLeave · payroll · calendar
8
EmployeeEmployee notified

User task
Automated step
Decision
Timer · escalation
Live request

The same engine, across every module

Finance: journal approvals, payment runs, period close and invoice matching exceptions.
Procurement: purchase requests, RFQ and tender awards, and contract variations.
Oil & Gas: AFE approvals with partner consent, budget revisions and cost allocations.
Logistics: rate exceptions below margin, customs holds and cargo release gates.
HR: leave, overtime, recruitment, salary revisions, performance reviews and final settlement.
Documents: policy reviews, contract signing and certificate renewals.

Routing by Delegation of Authority

The Delegation of Authority is the rulebook of an organisation: who may approve what, up to which amount, for which kind of spend. In SBC ERP it is held as data in the Core, versioned and effective-dated, and every workflow reads it at run time. Approvers are defined by position, never by name, so when people change roles, go on leave or leave the company, routes stay correct without anyone editing a workflow.

The same purchase request can therefore follow very different paths. A small order goes to the line manager; a larger one adds the department head; a major commitment runs Finance and the General Manager in parallel; and spend above the highest threshold also requires the CEO and, for a joint venture, partner consent. Delegation to a deputy, deadlines and escalation are applied automatically, and the exact DOA version used is stored with each approval.

DOA as versioned data

Limits by amount, category, cost object and entity, with effective dates and full change history.

Positions, not people

Routes resolve to the current holder of a position, including acting appointments and deputies.

Conditions on any field

Route on amount, currency, cost centre, AFE, supplier risk, contract type, partner share or any custom field.

Proof for auditors

Every decision stores who approved, under which rule and version, with the evidence they saw.

Dynamic routing · demoLIVE

One workflow, the right approvers every time

The purchase request workflow is designed once. At run time the engine reads the amount, the cost object and the Delegation of Authority, and builds the route, with parallel approval and delegation when someone is away.

Purchase requestPR-2044Gas lift package · 3 wellsOMR 412,000AFE-2211 · Block 5

Delegation of Authority · v3

Up to OMR 5,000Line manager
Up to OMR 50,000Line manager → Department head
Up to OMR 250,000Department head → Finance + GM
Above OMR 250,000GM → CEO → JV partners

Route resolved at run timeSLA 24 h per step · auto-escalation

✓ Approved · commitment reserved and the purchase order released to Procurement

Awaiting decision
Approved
Delegated
Parallel approval

04

Business modules

Every SBC ERP edition includes a common layer of business modules. They cover the capabilities every organisation relies on, from customer engagement and communication to documents, analytics and integration, and they share one data model, so information captured once is available everywhere.

How it works

Lead-to-cash

Enquiry received
Customer
A prospect makes contact by WhatsApp, email or phone, and every channel lands in one place.
Lead qualified
CRM
The contact and opportunity are created automatically in Contacts and CRM, with the full conversation history attached.
Proposal issued
Proposals
The commercial team builds the offer in Proposal Management and issues it on company letterhead.
Contract signed
Sign
The customer signs electronically; the signature and its evidence are stored with the deal.
Invoiced and collected
Invoices
Invoice Management issues the invoice and tracks it through to payment.
Performance measured
Reports & KPI
Pipeline, conversion and revenue flow into Reports and KPI dashboards, with AI-generated insight.

ResultOne continuous journey from first contact to cash, with a single record and no re-keying between systems.

Customer engagement & communication

Documents & signature

Company DocumentsA governed library for policies, contracts and corporate records.
The official library for policies, procedures, contracts and certificates, with versions, owners, review dates and access control, so everyone works from the current approved version.
How it works
1. 1Draft
2. 2Review
3. 3Approve
4. 4Publish
5. 5Retire
Standards & frameworks
- ISO 15489-1:2016 (opens in a new tab)ISO
  Principles for creating, capturing and managing records that remain authentic, reliable and usable.
- ISO/IEC 27001 (opens in a new tab)ISO / IEC
  The international standard for information security management systems, covering risk assessment and security controls.
SignCryptographically verifiable electronic signatures for documents and approvals, based on the Nostr protocol.
Electronic signing for contracts, approvals and internal forms, with verified signer identity, trusted timestamps and a tamper-evident completion certificate. Every signature is created cryptographically according to the Nostr protocol: the document is hashed with SHA-256 and signed with a Schnorr signature on secp256k1, so its integrity and signer can be verified independently.
How it works
1. 1Prepare
2. 2Hash (SHA-256)
3. 3Sign (Schnorr)
4. 4Verify
5. 5Archive
Standards & frameworks
- Nostr NIP-01: events and signatures (opens in a new tab)Nostr protocol
  Defines how a signed record is built: the content is serialised, hashed with SHA-256 to a unique ID and signed with the signer’s private key, so anyone can verify it independently with the public key.
- BIP-340 Schnorr signatures (secp256k1) (opens in a new tab)Bitcoin Improvement Proposals
  The Schnorr signature scheme on the secp256k1 curve used by Nostr: compact 64-byte signatures, provably secure and fast to verify.
- eIDAS Regulation (EU) 910/2014 (opens in a new tab)European Union
  The benchmark legal framework for electronic signatures, seals and timestamps and their legal effect.
- ETSI EN 319 142 (PAdES) (opens in a new tab)ETSI
  The PDF signature format for signed documents that remain verifiable over the long term.
- Time-Stamp Protocol (RFC 3161) (opens in a new tab)IETF
  Trusted timestamps that prove exactly when a document was signed.
- Electronic Transactions Law (Royal Decree 69/2008) (opens in a new tab)Sultanate of Oman
  Gives electronic records and electronic signatures legal recognition in Oman.

Analytics & performance

Commerce & integration

AI & enablement

AI AgentsAutonomous agents that execute cross-module processes, with human approval where it matters.
Agents that carry out multi-step business tasks across modules, using exactly the same permissions and approvals as people.
How it works
1. 1Goal
2. 2Plan
3. 3Act via MCP
4. 4Human approval
5. 5Audit
Standards & frameworks
- ISO/IEC 42001:2023 (opens in a new tab)ISO / IEC
  The first international management-system standard for the responsible development and use of AI.
- NIST AI Risk Management Framework (opens in a new tab)NIST
  A framework for identifying, measuring and managing the risks of AI systems.
- OWASP Top 10 for LLM Applications (opens in a new tab)OWASP
  The most critical security risks for applications built on large language models, such as prompt injection.
- Model Context Protocol (opens in a new tab)Open standard
  The open protocol that connects AI models to tools and data in a consistent, governed way.
Training CenterRole-based training, onboarding and user enablement.
Role-based courses, onboarding paths and assessments that make every user productive quickly and keep skills current.
How it works
1. 1Assign
2. 2Learn
3. 3Assess
4. 4Certify
Standards & frameworks
- Experience API (xAPI) (opens in a new tab)ADL Initiative
  Records learning activity across systems in a standard, portable format.
- ISO 10015:2019 (opens in a new tab)ISO
  Guidelines for competence management and people development.

Select any module to see how it works and the standards it is designed around. Standards listed are the international frameworks, regulations and best practice each module aligns with; formal certification and compliance commitments are defined for each engagement.

Real-time insight

Because every business module writes to the same platform, management information is a by-product of daily work, not a project at month end. An invoice issued in the morning is in the revenue figure a second later; a purchase order approved after lunch is already committed against its budget; a payment run updates the cash position as it executes.

Dashboards and KPIs are defined once and drill down to the transaction behind every number, in Arabic and English. AI adds context: it explains why a figure moved, highlights what is unusual and answers follow-up questions in plain language.

Real-time insight · demoLIVE

Every transaction, reflected the moment it posts

Because every module writes to one platform, management figures never wait for a month-end export. Each event below updates the cockpit as it happens.

Revenue · this monthOMR 1,284,600

Cash positionOMR 642,180

AFE-2207 · committed vs budgetOMR 412,300budget OMR 525,000

Open approvals7 itemsAverage age 9 h · none overdue

Live activity

Sales & invoices
Treasury
Procurement
Accounting

05

Oil & Gas edition

The Oil & Gas edition is designed for upstream operators, joint-venture partners and oilfield service companies. It connects the full capital and operating cycle, from blocks and participating interests through AFEs, budgets, procurement and inventory to accounting, partner allocation and regulatory reporting, in a single controlled system of record.

Every expenditure is authorised before it is committed, measured against budget as it happens, and traceable from the AFE to each partner’s share and to EPSA cost-recovery and IFRS reports.

How it works

Authorise-to-allocate: from AFE to partner reporting

Joint venture defined
Block
Block Management holds partners, operatorship and effective-dated participating interests.
Expenditure authorised
AFE
An AFE is raised and approved within the limits of the Delegation of Authority and, where required, by partners.
Funds committed
Budget
The approved amount is reserved against the budget, preventing overspend before it occurs.
Sourced and contracted
Procurement
Requisition, RFQ or tender, technical then commercial evaluation, and award to a purchase order or contract.
Received and capitalised
Inventory & Assets
Materials are received into stock and equipment is registered and capitalised as a fixed asset.
Matched, paid and allocated
Accounting
Invoices are three-way matched and paid through Treasury, and costs are allocated to partners by share.
Reported in real time
Reports
Budget vs. actual, AFE status, IFRS statements and EPSA cost-recovery reports update continuously.

ResultComplete spend control and a clean audit trail from authorisation to each partner’s share.

Department map

Capital spend across departments

1
OperationsField requirementProject & WBS
2
OperationsRaise AFEAFE draft
3
Budget & TreasuryBudget checkFunds reserved
4
Management & JVAFE approvalGateApproved by DOA
5
OperationsPurchase requestPR linked to AFE
6
ProcurementRFQ / tenderSealed bids
7
ProcurementBid evaluationTechnical, then price
8
Management & JVAward approvalGateApproved award
9
ProcurementPO / contractCommitment
10
Warehouse & AssetsGoods receiptGRN · asset tag
11
Accounting3-way matchInvoice posted
12
Budget & TreasuryPayment runGateBank transfer
13
AccountingPartner allocationCosts by share
14
Management & JVReportingEPSA · IFRS · BvA

Department step and the record it creates
Approval gate
Hand-off between departments

Accounting for oil & gas and logistics

Oil and gas accounting is unlike any other. Costs are incurred under AFEs, shared between joint-venture partners by participating interest, recovered under production sharing agreements, and reported both under IFRS and to the government. Logistics has its own needs: job costing, accruals for carrier costs not yet invoiced, revenue recognised as services are performed and margins tracked per shipment.

SBC ERP handles both natively, on one general ledger with multiple companies, currencies and calendars. Every transaction carries its AFE, WBS, block, partner, job or cost centre, so the same entry feeds statutory accounts, partner billing, cost recovery and management reporting without re-entry.

Joint-venture accounting

Participating interests by block and date, cash calls, joint-interest billing and partner statements.

Cost recovery & EPSA

Cost pools, recoverable and non-recoverable costs, profit oil and government reporting.

IFRS for the industry

Exploration and evaluation (IFRS 6), joint arrangements (IFRS 11), leases (IFRS 16) and revenue (IFRS 15).

Logistics job costing

Revenue, cost and margin per job, with accruals for open carrier and agent charges.

Multi-company & multi-currency

Consolidation, intercompany, revaluation and OMR, USD and other currencies side by side.

Tax & e-invoicing

Oman VAT, withholding tax and the five-corner e-invoicing model built into every invoice.

Joint-venture accounting · demoLIVE

Post once, and every partner’s share is right

A drilling invoice is posted against an AFE. The ERP splits it by each partner’s effective-dated interest, separates recoverable from non-recoverable cost, and updates partner billing, cost recovery and IFRS reporting in the same step.

Supplier invoice posted

AP-20931 · Drilling servicesAFE-2207 · Block 5 · WBS 2.3 Well B5-14

OMR 120,000

Participating interests · Block 5Effective 1 Jan 2026

Operator45%OMR 54,000
Partner B35%OMR 42,000
Partner C20%OMR 24,000

Cost recovery under the EPSA

Recoverable · development cost poolOMR 112,400
Non-recoverable · contractor standby faultOMR 7,600

Updated automatically

Joint-interest billing · 2 partner statements
Cash call reconciled
EPSA cost-recovery report
IFRS 11 share in each ledger

Operator · 45%
Partner B · 35%
Partner C · 20%
Non-recoverable

What the operator no longer does by hand

Splitting each invoice, timesheet and stock issue between partners in a spreadsheet.
Re-classifying costs for the cost-recovery report after the books are closed.
Preparing partner billing statements and cash-call reconciliations from separate extracts.
Restating history when a participating interest changes: effective dates make the split right for each period automatically.

Procurement & contract workflows

From a field requirement to a paid invoice, every procurement step runs on the dynamic workflow engine with your Delegation of Authority. Requisitions are checked against budget and stock, sourced by RFQ or formal tender with sealed bids and separate technical and commercial evaluation, awarded to purchase orders or contracts, and tracked through delivery, receipt, matching and payment.

Contracts are managed as living records: rates, call-offs, variations, expiries, guarantees and performance, with alerts before anything lapses. In-Country Value commitments and spend with local suppliers are measured automatically for reporting.

Requisition
Raised from a project, work order or stock level, checked against budget and AFE before it moves.
Sourcing
RFQ or tender with sealed bids, clarifications, and technical then commercial evaluation.
Award & contract
Award approved under DOA, converted to a purchase order or contract with rates and terms.
Delivery & receipt
Goods received or services confirmed, inspected and recorded against the order.
Match & pay
Three-way match, tolerances, approval and payment run, with ICV and supplier performance captured.

Asset management

Wells, pipelines, rotating equipment, vehicles and facilities are where the money in oil and gas is spent. SBC ERP manages every asset across its full life: acquisition and capitalisation from a purchase order or project, location and hierarchy, preventive and predictive maintenance, inspections and integrity, spares, depreciation, impairment and disposal.

Because maintenance, inventory, procurement and accounting share one platform, a breakdown raises a work order, reserves spares, creates a purchase request if stock is short, and posts the cost to the right asset, AFE and partner automatically. AI adds failure prediction and condition-based maintenance on top.

Asset register & hierarchy

Sites, systems, equipment and components, with tags, documents and history.

Maintenance

Preventive plans, work orders, permits, labour and spares, plus predictive alerts from sensors.

Integrity & inspection

Inspection schedules, findings, risk ranking and corrective actions.

Depreciation & impairment

Component depreciation and impairment testing in line with IAS 16 and IAS 36.

Predictive maintenance · demoLIVE

From a sensor trend to a planned repair, automatically

Condition data from the field is read against each asset’s alarm levels. When AI sees a failure coming, one event raises the work order, reserves spares, orders what is missing and captures every cost against the right asset, AFE and partner.

Asset P-101 · Export pump · Station 3Vibration velocity mm/s · 30 days

2.1 mm/s

Alarm level crossed on day 27AI compared the trend with past seal failures on similar pumps

Baseline: 2.3 mm/s
Latest: 5.6 mm/s
Next PM due: in 41 days

AIFailure predictedMechanical seal wear · failure likely within 9 days · 87% confidence
MaintenanceWork order WO-7731Priority high · planned for Thursday’s shutdown window
InventorySpares reservedSeal kit SK-40: 1 reserved in Fahud store · 1 short
ProcurementPurchase request PR-20521 seal kit from contract C-311 · budget checked on AFE-2207
HSEPermit to work issuedIsolation plan attached · approved by area authority
AccountingCost capturedLabour and parts to asset P-101 · AFE-2207 · shared by partner

Sensor trend
Alarm level
AI prediction
Action completed

Predictive maintenance uses condition data from existing plant historians, SCADA or IoT gateways through the integration layer; SBC ERP does not replace control systems.

Everything an oil & gas business needs

Upstream operations

Blocks, wells, production, AFEs, budgets and partner reporting.

Finance

JV accounting, cost recovery, treasury, IFRS and tax, in one ledger.

Supply chain

Procurement, tenders, contracts, inventory, warehouses and logistics.

Assets & maintenance

Asset lifecycle, maintenance, integrity and predictive AI.

People & contractors

HR, payroll, rotations, competencies and contractor certifications.

HSE & compliance

Permits, incidents, inspections, audits and verifiable records.

Projects

WBS, schedules, progress, cost control and earned value.

Intelligence

Semantic search, local AI, decision support and dynamic reports across all of it.

Procure-to-pay controls

In capital-intensive operations, a weak link between ordering, receiving and paying costs real money: duplicate payments, invoices for goods never received, prices that drift from the contract. SBC ERP closes that gap with controls that run automatically on every transaction, instead of being sampled by auditors months later.

Every supplier invoice, whether it arrives as an e-invoice, a PDF read by AI or a manual entry, is matched against its purchase order and goods receipt. Quantities, prices, taxes and totals are compared line by line; differences within the tolerance your finance policy allows are accepted and logged, and anything outside it goes to the right person with the evidence attached.

Procure-to-pay control · demoLIVE

Three-way match, checked line by line

An invoice is paid only when it matches what was ordered and what was received. SBC ERP checks every line automatically and sends only real exceptions to people.

Purchase orderPO-10482Approved · 2 Oct

Goods receiptGRN-7731Stores · 9 Oct

Supplier invoiceINV-2026-0471E-invoice · 12 Oct

LineOrderedReceivedInvoicedResult

Pump mechanical seal20 × 45.00020 received20 × 45.000Exact match

Bearing 6312 C34 × 85.0004 received4 × 85.400Price +0.47% · within 1% tolerance

Shaft alignment service1 × 400.000Service confirmed1 × 400.000Exact match

Invoice totalOMR 1,723.680incl. VAT 5% · PO value OMR 1,722.000 · difference OMR 1.680

Matched and posted to accounts payableAP-10482 · scheduled in Thursday’s payment run · no human touch

Being compared
Matched
Within tolerance

Controls applied to every invoice

Two- and three-way matching against purchase orders, goods receipts and service confirmations.
Price and quantity tolerances set by policy, by category and by supplier.
Duplicate detection across invoice numbers, amounts, dates and bank details.
Budget and AFE checks before commitment, and cost allocation to partners after payment.
Segregation of duties: the person who orders cannot receive, approve and pay the same purchase.

06

Logistics edition

The Logistics edition is designed for freight forwarders, carriers, warehouse and yard operators and cargo agents. It manages every shipment as a single job, from quotation and booking through documentation, customs, transport and cargo release to billing and close, with live status and profitability at every step.

Commercial, operational and financial teams work from the same record, so margins are protected at quotation, controls are enforced at every gate, and each job closes with its true profit.

How it works

Book-to-bill

Job opened
Job
A confirmed booking becomes a Logistics Job, the single file for the shipment.
Priced within margin
Rates
Rates come from approved rate cards; any quote below the margin floor requires approval.
Documents issued
Documents
Bills of lading or air waybills are issued, with dangerous-goods evidence where required.
Customs cleared
Customs
The customs file is prepared, submitted and cleared, or escalated as an exception.
Moved and stored
Transport & Yard
Transport is dispatched and tracked by milestone; cargo is received and stored in the warehouse or yard.
Cargo released
Release gate
Cargo is released only when documentation, customs and payment checks are all complete.
Billed and closed
Billing
Charges are invoiced, the job margin is posted to Accounting and the job is closed.

ResultReal-time status and profit for every shipment, and no cargo released before every control has passed.

Logistics operations

Finance & back office

Process map

Shipment lifecycle across departments

1Commercial
EnquiryLead & opportunity
2Commercial
QuotationQuote from rate card
3Commercial
Margin approvalGateApproved by GM
4Customer
AcceptanceSigned quote
5Operations
BookingLogistics Job opened
6Operations
Carrier confirmationSpace & schedule
7Docs
Shipping instructionsSI captured
8Docs
DocumentsB/L · AWB · DG
9Transport
PickupTransport order
10Operations
Port / airportGate-in
11Customs
Customs clearanceGateDeclaration cleared
12Operations
LoadingLoaded on board
13Service
TrackingLive milestones
14Operations
ArrivalArrival notice
15Agency
Delivery orderGateRelease checks passed
16Transport
Final deliveryProof of delivery
17Finance
InvoiceJob invoice
18Finance
CollectionPayment received
19Finance
File closeGateMargin posted, job closed

Commercial CRM · Freight Rates
Customer WhatsApp · Email · Sign
Operations Logistics Job
Documentation & Customs Shipment Documents · Customs & Trade
Transport Transport Execution · Fleet
Customer service Messenger · WhatsApp
Finance Logistics Billing · Accounting
GateApproval or control gate

Live shipment control

A logistics business makes or loses money one job at a time, and usually finds out weeks later when the carrier invoices arrive. In SBC ERP every job carries its own live profit and loss. The sell side is known from the approved quotation; each cost is accrued the moment it is known, from the carrier booking, port and terminal events, customs, trucking and storage, and replaced by the actual invoice when it arrives.

Milestones come from carriers, ports, customs and drivers through the integration layer and the WhatsApp channel, so customer service sees the same status as operations. Exceptions, such as a customs inspection, a missed cut-off or demurrage starting, appear on the job immediately with the cost they will cause. Cargo release is a hard control: the delivery order cannot be issued until documents, customs and payment or approved credit are complete.

Live job P&L

Revenue, accrued cost and margin per job, per customer and per lane, updated with every event.

Margin floor

Quotes and extra charges below the agreed margin are routed for approval before the customer sees them.

Exception management

Holds, delays, demurrage and damage raise tasks with owners and deadlines on the job.

Release under control

Documents, customs and payment checks gate every release, with a permanent record of who released what, and when.

Logistics job · demoLIVE

Every shipment tracked, costed and released under control

Milestones from carriers, ports and customs update the job as they happen. Costs accrue the moment they are known, so the margin is always current, and cargo cannot be released until every control has passed.

Logistics jobLJ-2301 · 2 × 40′ HC · Compressor spares

Booked

ShanghaiCNSHABooked · loaded on board
Jebel AliAEJEATranshipment
SoharOMSOHArrived · customs
Ibri siteIBRIDelivered · POD

Job profitability · live

Revenue (sell): OMR 4,850
Cost accrued: OMR 0

Margin100.0%

Margin floor 15%

Cargo release gate

DocumentsOriginal B/L awaited
CustomsDeclaration not yet filed
PaymentInvoice INV-L-5521 open

Release blocked

Milestone
Cost accrued
Exception
Control passed

07

Real Estate & Construction edition

The Real Estate & Construction edition is designed for property developers, landlords and asset owners, property and facility managers, brokers, and the contractors who build for them. Its centre is the unit: every villa, apartment, office and shop is a living record, from the day it is released for sale to the day it is sold, handed over, leased, renewed and maintained.

Sales teams see live availability on the masterplan and stacking plan, reserve units on payment plans and sign contracts electronically, while instalments, escrow and registration are tracked to the last baisa. Leasing teams run tenancies, rent collection, renewals and service charges, and facility teams answer every maintenance request against the right unit and contract.

Behind it, the construction side controls cost against the bill of quantities, certifies payments on measured progress and links each construction milestone to the buyer instalments that depend on it, so the developer, the contractor and the finance team share the same truth on any day of the project.

How it works

Estimate-to-handover

Project estimated
Estimation
Quantities and rates are built into a priced bill of quantities (BOQ), with the cost plan broken down by WBS and trade.
Tendered and awarded
Tender
Packages are tendered to subcontractors and suppliers, bids are levelled against the BOQ and the award is approved under DOA.
Budget committed
Budget
Each award reserves budget against its BOQ lines, so overruns are visible before the work is done, not after.
Progress measured
Site
Site teams record daily reports, measured quantities, photos and safety observations from the field app.
Payment certified
IPC
Interim payment certificates are calculated from measured progress, with retention, advance recovery and variations applied automatically.
Units sold and collected
Sales
Off-plan units are reserved, contracted and invoiced on payment plans linked to construction milestones.
Handed over and operated
Handover
Snags are closed, units are handed over, retention is released and the building moves to leasing and facility management.

ResultCost, progress, sales and cash for every project in one live view, from the first estimate to the last service charge.

Real estate & property

Construction & projects

Finance & back office

Process map

A development, from land to handover

1Development
FeasibilityProject & budget
2QS
EstimatePriced BOQ
3Development
Budget approvalGateApproved by board
4Sales
Unit releasePrice list published
5Procurement
TenderBids levelled
6Procurement
AwardGateSubcontract signed
7Site
MobilisationSite set up · permits
8Sales
ReservationsUnits reserved
9Site
Daily progressQuantities measured
10QS
Payment certificateGateIPC certified
11Finance
Subcontractor paymentNet of retention
12Sales
Milestone invoicesBuyer instalments
13Finance
CollectionsEscrow receipts
14QS
VariationsChange orders agreed
15Site
CompletionGateSnags closed
16Sales
HandoverKeys & handover pack
17Finance
Retention releaseGateFinal account
18Property
LeasingLeases & rent
19Property
Facility managementWork orders · service charge

Development Property & Units · Budget
Commercial & QS Estimation · Contracts · IPC
Procurement Tendering · Procurement
Site Site Progress · HSE · Plant
Sales Reservations · Payment Plans
Finance Accounting · Finance
Property management Leasing · Facility Management
GateApproval or control gate

Sell, lease and manage every unit

A developer’s revenue lives in its units, yet availability usually sits in a spreadsheet, payment plans in accounting, tenancies in a leasing tool and maintenance in someone’s inbox. In SBC ERP every unit is one record across its whole life, shown on an interactive masterplan and stacking plan that sales, leasing and facilities all work from.

An enquiry from WhatsApp, the website or a broker is matched by AI to available units that fit the buyer’s brief. A reservation creates the payment plan, collects the booking into escrow and prepares the sales and purchase agreement for electronic signature. Once handed over, the same unit carries its lease, rent schedule, service charges and maintenance history, so occupancy, collections and tenant satisfaction are measured from live data.

Live availability

Masterplan and stacking plan coloured by status, with price lists, holds and broker allocations.

AI matching

Buyer and tenant briefs in Arabic or English matched to units by budget, size, view and handover date.

Payment plans & escrow

Date or milestone plans, payment links, escrow reconciliation and reminders on WhatsApp.

Leasing & renewals

Tenancies, rent schedules, deposits and AI-suggested renewal rents based on the market.

Facility management

Requests from the tenant app become work orders, dispatched, tracked and rated.

Portfolio KPIs

Sales value, absorption, collections, occupancy and rent roll for every project and building.

Property sales & leasing · demoLIVE

Every villa sold, leased and looked after from one masterplan

An enquiry is matched to available units, reserved on a payment plan and signed electronically. The same record then collects the rent, dispatches maintenance and fills vacancies, so sales, leasing and facilities never lose sight of a unit.

Al Qurum Gardens18 villas · sea & park

AR

Ahmed R.New enquiry · WhatsApp

AISearching available villas…

Villa V-12Available

3 bed · 310 m² · park view · ready Q4 2027

List priceOMR 176,500

Payment plan · V-12Reserved

Booking 10%Today17,650
Structure complete 20%Mar 202735,300
Finishes complete 20%Nov 202735,300
Handover 50%On keys88,250

Sales & purchase agreementSigned · sent for registration

Tenancy · V-03Leased

Al Balushi family · 12 months · ends Aug 2027

October rentOMR 950

Due today · link sent on WhatsApp

AIRenewal in 60 days · market supports +4%

Work order WO-311 · V-07Urgent

“AC not cooling in the master bedroom”

Reported in the tenant app09:12
Assigned to Hamed · HVAC09:14
Technician on site10:05
Fixed · gas recharged10:52

Tenant rated ★★★★★

Activity

Villas sold6/18
Sales valueOMR 1,034,000
Escrow balanceOMR 412,800
Occupancy92.4%
Rent · OctOMR 184,350

Available
Reserved
Sold
Leased

Live project and property control

In real estate the money moves on two tracks at once. The contractor is paid on measured progress, net of retention and advance recovery, while buyers pay instalments that fall due when the building reaches each milestone. When those tracks live in different systems, nobody knows the project’s true cash position until month end.

In SBC ERP both tracks run from the same progress. When the consultant certifies a payment certificate, the contract value, cost to complete and revenue recognised update together, and every buyer whose instalment depends on that milestone is invoiced automatically. Each unit on the tower shows its status, from available to reserved, sold and handed over.

BOQ cost control

Budget, committed, certified and forecast cost for every BOQ line, trade and floor.

Payment certificates

Gross value, retention, advance recovery and variations calculated for every IPC, client or subcontractor.

Milestone-linked collections

Buyer instalments invoiced the moment a construction milestone is certified, with escrow receipts.

Unit availability

A live stacking plan of every unit, from reservation to handover, with prices and buyers.

Development project · demoLIVE

From the first slab to the last key, on one record

Site progress certifies the contractor's payments and, at the same moment, invoices the buyers whose instalments depend on that milestone. Every window is a unit on the stacking plan, so sales and construction are always read together.

Tower B · Qurum HeightsG+10 residential · 40 units

Mobilised

0%Physical progress

Site mobilised · permits issued

Payment certificateIPC-00

Work done to date: 0
Less retention 10%: 0
Less advance recovery 10%: 0
Less previous certificates: 0
Net payable OMR: 0

Retention heldOMR 0

Units · stacking plan0/40 sold

Sold 0
Reserved 0
Available 40

Collected from buyersOMR 0

Instalments follow construction milestones

Foundation
Structure 50%
Topped out
MEP & finishes
Handover

Unit sold
Unit reserved
Off-plan floor
Certified

08

E-invoicing

Oman is moving business-to-business invoicing onto a national e-invoicing framework built on the five-corner model. Instead of emailing PDFs, the seller’s system sends a structured invoice through an accredited service provider, the invoice reaches the buyer through the buyer’s provider, and the Oman Tax Authority receives the tax data from both sides in near real time.

SBC ERP is built for this model from the ledger up. Invoices are issued as structured data rather than documents, validated before they leave, exchanged through the Exchange and Webhooks integration layer, and tracked message by message. Every acknowledgement is written back to the invoice, so finance always knows whether an invoice was received, reported and delivered.

Incoming e-invoices arrive the same way in reverse: they are matched to purchase orders and goods receipts, routed through the dynamic workflow engine for approval and posted to accounts payable without re-keying.

Structured invoices

Invoices generated as machine-readable data (UBL-based), with tax codes, totals and party identifiers validated before submission.

Service-provider connectivity

Connects to the accredited service providers in Corners 2 and 3 through published APIs, with retries and full message logs.

Real-time tax reporting

Tax data is reported to the Oman Tax Authority as invoices are issued and received, not reassembled at the end of the period.

Status on every invoice

Receipt, tax and delivery acknowledgements appear on the invoice itself, with alerts when an expected acknowledgement is late.

Inbound automation

Received e-invoices are matched to POs and receipts, approved by workflow and posted to accounts payable automatically.

Archive & audit

The exact message sent, every acknowledgement and every correction are retained with timestamps for audit.

How it works

The five-corner B2B e-invoice model

Every invoice travels between accredited service providers, and the Oman Tax Authority receives the tax data from both sides of the transaction.

1
Seller → Service providerInvoice
SBC ERP issues the structured invoice and sends it to the seller’s accredited service provider.
2
Service provider → SellerReceipt acknowledgement
The provider validates format and content and confirms receipt; the status appears on the invoice in the ERP.
3
Service provider → Oman Tax AuthorityInvoice tax data
Tax data from the invoice is reported to the Oman Tax Authority.
4
Oman Tax Authority → Service providerTax data acknowledgement
The Tax Authority acknowledges the tax data it received.
5
Service provider → Service providerInvoice data
The invoice travels across the network to the buyer’s service provider.
6
Service provider → Service providerData acknowledgement
The buyer’s provider confirms that the invoice arrived intact.
7
Service provider → BuyerInvoice data
The buyer receives the invoice, ready to post straight into accounts payable.
8
Service provider → Oman Tax AuthorityReceived invoice tax data
The buyer’s provider reports the received invoice to the Tax Authority, closing the loop.

Business message
Acknowledgement
Tax authority

Technical specifications, onboarding phases and timelines follow the official publications of the Oman Tax Authority. SBC ERP connects through accredited service providers.

09

Security

Security in SBC ERP is architectural, not an afterthought. It follows a zero-trust, defence-in-depth model: every control is enforced on the server for every request, whether it originates in the web console, the API, a background job, a workflow or an AI agent.

How it works

Defence in depth on every request

Traffic screened
Gateway
Rate limits and abuse controls stop excessive or malicious traffic before it reaches the application.
Identity verified
Auth
The signed session is validated for integrity and expiry. No valid session, no access.
Input validated
Validation
Every field is checked against a strict schema at the API edge; anything unexpected is rejected.
Authorisation enforced
Permissions
The exact permission for the action is verified on the server, independent of the user interface.
Tenant and record rules applied
Data scope
Queries are constrained to the user’s company and to the records they are entitled to access.
Sensitive fields filtered
Field security
Restricted fields, such as salaries, are removed before the response is built.
Recorded and answered safely
Audit
Every change is written to the audit trail, and responses never expose internal detail.

ResultSeven independent layers of protection, enforced on the server, on every request.

Permission-based access control

Every action is governed by a granular permission rather than a role name, and re-verified on the server. The interface is never trusted on its own.

Multi-tenant isolation

Every query and transaction is scoped to its tenant before any other filter is applied, so no company can ever see another’s data.

Record-level security

Users read and change only the records they own or are assigned, enforced within the database queries themselves.

Field-level security

Sensitive fields can be hidden or made read-only by permission, so restricted data never leaves the server.

Authentication & sessions

Hashed credentials, signed sessions with expiry, single sign-on and a secure password-reset flow, with authentication required at every entry point.

Comprehensive audit trail

Every change to data, files, settings, permissions and modules is logged with before and after values, user, IP address and device.

Input validation

All external input is validated at the API boundary. Client-supplied flags, role names and URLs are never used to grant access.

Injection prevention

All database access uses parameterised queries through a typed query layer, eliminating SQL injection by construction.

Secure file access

Files are protected by ownership and visibility rules, storage locations are never exposed, and every download is authorised at the moment of request.

Secrets & transport hardening

Secrets are held outside the code base, and every response carries strict security headers, including HSTS and frame and content-type protection.

Rate limiting & abuse protection

Public and authentication endpoints are rate-limited, and abusive sources are blocked automatically against brute-force and denial-of-service attempts.

Centralised privileged access

Administrative elevation is handled by a single, central authorisation layer, keeping privileged access controlled and fully auditable.

Safe error handling

Errors returned to users are generic and safe. Stack traces, query details and internal information are never disclosed.

Module isolation

Modules operate behind typed contracts and events and cannot reach into each other or the Core, containing the impact of any single module.

Defence in depth, in action

Layers matter because each one catches what another might miss. A user who is properly signed in may still try to send a field they should not control; a valid permission may still be used to reach another company’s data; a legitimate read may still include a salary the reader is not entitled to see. Each layer answers one question, independently, and a request is only answered when all of them agree.

When a request is rejected, the response tells an attacker nothing useful: no stack trace, no hint whether the record exists. The full detail goes to the audit trail and to security monitoring instead, so administrators can see attempted misuse as it happens.

Defence in depth · demoLIVE

Seven checks on every request, enforced on the server

Each request passes the same seven layers, whether it comes from a browser, the API, a workflow or an AI agent. Watch a normal request, an attempt to grant oneself admin rights and a cross-company read.

Incoming request

01Gateway
02Authentication
03Validation
04Permissions
05Data scope
06Field security
07Audit

Response

Written to the audit trail with user, IP address, device and time

Checking
Passed
Rejected
Restricted field removed

Data protection & privacy

An ERP holds some of the most sensitive data an organisation has: salaries, identity documents, bank details, medical leave, customer contracts. SBC ERP is designed so that personal data is collected for a purpose, seen only by those who need it, kept only as long as required and always traceable.

The platform is designed to support compliance with Oman’s Personal Data Protection Law and with international practice such as ISO/IEC 27001 and ISO/IEC 27701. Formal compliance responsibilities, hosting location and retention policies are agreed for each engagement.

Data residency: hosting on-premise or in an in-country cloud in Oman, including backups, search indexes and AI models.
Purpose and consent recorded for personal data captured from customers and candidates, including WhatsApp opt-in.
Field-level protection for salaries, national IDs, bank accounts and health information, by permission.
Retention rules per document type and record, with controlled archiving and deletion.
Data subject requests supported by enterprise search across records, documents and conversations.
Encryption in transit and at rest, and every access to sensitive records written to the audit trail.

10

Platform & delivery

SBC ERP is a modular platform with a single, consistent architecture. The Core provides identity, organisation, workflow, documents, audit and search as shared services. Modules are packaged separately, communicate with the Core and with each other through typed contracts, events and MCP, and are never allowed to reach directly into another module’s data. The web console, the public API, workflows and AI agents all go through the same service layer, so every channel obeys the same rules.

The platform runs wherever your policies require: your own servers, your private cloud or an in-country data centre in Oman. SBC deploys it into your environment and does not host it. The same release runs in each, so every customer receives the same features and fixes.

Layered architecture

Presentation, API, service, module and data layers, each with a single responsibility and enforced boundaries.

Deployment choice

Your own servers, your private cloud or an in-country data centre, with the same edition release everywhere.

Multi-company & multi-tenant

Many legal entities, branches, currencies and calendars in one instance, with strict isolation between tenants.

Scalability

Stateless application services scale horizontally; heavy work such as reports, AI and imports runs in background queues.

Availability & recovery

Automated backups, tested restores and recovery objectives agreed for each deployment.

Observability

Health checks, metrics, structured logs and alerts, so issues are found before users report them.

Open integration layer

REST APIs described with OpenAPI, signed webhooks, structured file exchange, ISO 20022 banking and Oman e-invoicing.

Arabic & English throughout

Right-to-left interface, bilingual master data, documents and reports, and search in both languages.

Verified, immutable releases

Upgrades are where many ERP programmes lose control. SBC ERP ships each edition as an immutable release: a manifest listing the exact version of the Core and of every module, with a SHA-256 checksum for each package. A module version is admitted to an edition only after automated tests, a security scan, a check that its contracts with the Core and other modules still hold, and certification by SBC.

At deployment, every package is verified against the manifest before it starts; anything that does not match is refused. Every environment, from test to production, can therefore prove exactly what it runs, and a release can be rolled forward or back as a unit.

Verified releases · demoLIVE

Nothing reaches production unless it is tested, certified and verified

Every module version is admitted only after tests, a security scan and a contract check. The edition is sealed in a manifest of exact versions and SHA-256 checksums, and production refuses to start anything that does not match.

Module admission

Module	Tests	Security scan	Contracts	Certified
SBC Core4.2.0
Accounting3.8.1
Procurement3.6.0
AFE & Budget2.9.4
Logistics Job2.4.3

manifest.jsonSealed

"edition": "OG-2026.10""core@4.2.0": "9f2c41e7…b06d""accounting@3.8.1": "4a7d0c93…11e2""procurement@3.6.0": "c81be5f0…7a3c""afe-budget@2.9.4": "07e6a2d8…f45b""logistics-job@2.4.3": "e3f9187b…2c90"

ProductionRunning OG-2026.07

Waiting for a sealed release

Check passed
Checksum recorded
Verified at deployment

The same release is tested in UAT and promoted unchanged to production.
Customer-specific modules follow the same admission checks as SBC’s own.
Release notes, manifests and checksums are retained for audit.

Implementation & partnership

SBC delivers ERP as a long-term partnership: a proven implementation methodology, verified releases, open integration and a platform that continues to evolve with your business.

How it works

Implementation methodology

Discovery & process design
Discover
Workshops map your processes, Delegation of Authority, reporting and target module scope.
Configuration
Configure
Organisation, roles, workflows and modules are configured on the Core, never hard-coded.
Data migration
Migrate
Master data, open items and opening balances are migrated and reconciled with Finance.
Testing & UAT
Validate
Functional, integration, security and workflow testing, followed by acceptance testing by your users.
Go-live on a verified release
Deploy
Production runs a fixed, checksum-verified edition release, backed by hypercare support.
Training & knowledge transfer
Enable
Users and your technical team are trained, and customer-specific code is handed over with documentation.
Continuous innovation
Evolve
New modules, workflows, reports and AI capabilities are delivered as your business grows.

ResultA phased, low-risk rollout: finance, procurement and approvals first, then every remaining module on a stable foundation.

Data protection

Encryption in transit and at rest, with automated backups and tested recovery.

Verified, immutable releases

Each edition ships as a versioned release with SHA-256 checksums and a full manifest of Core and module versions. Every module is security-checked and certified before admission.

Open integration

REST APIs, signed webhooks and e-invoicing, with connectors for banks, attendance systems and existing applications.

Flexible deployment

Deployed on your own servers or your own cloud, in Oman if required. Fully bilingual in Arabic and English.

Phased implementation

Finance, procurement and approvals first, then the remaining scope, with data migration, testing, UAT and training included.

Ownership & knowledge transfer

Customer-specific code is delivered with documentation, and your technical team is trained to maintain and extend it.

Continuous innovation

New modules, workflows, analytics and AI capabilities are added over time, without replacing the Core.

Local support

Support from SBC’s team in Oman, with planned upgrades to each new edition release.

Glossary

Terms used in this whitepaper.

AFE

Authorisation for Expenditure: approval to spend a defined amount on a defined scope, such as drilling a well.

DOA

Delegation of Authority: the rules that define who may approve which transactions, up to which limits.

EPSA

Exploration and Production Sharing Agreement: the contract with the government that governs cost recovery and profit sharing.

Participating interest

A partner’s percentage share of a joint venture’s costs and production, effective from a given date.

Joint-interest billing

The operator’s periodic statement charging each partner its share of joint-venture costs.

MCP

Model Context Protocol: an open standard through which systems expose data and actions to AI in a governed way.

Open-weight model

An AI model whose weights can be downloaded and run on your own infrastructure, without an external service.

Three-way match

Checking a supplier invoice against the purchase order and the goods receipt before it is paid.

ICV

In-Country Value: spend and activity that benefit the Omani economy, measured and reported for contracts.

Five-corner model

The e-invoicing model in which seller, buyer, their service providers and the Tax Authority exchange invoice data.

Cargo release

The controlled hand-over of cargo to the consignee, permitted only after documents, customs and payment are complete.

Clean Core

An architecture in which customer and industry logic is kept out of the platform core, so the core can be upgraded safely.

SBC ERP: AI-Native Platform

Why SBC ERP

The challenge

Design principles

Clean Core

Composable by protocol

AI as a governed user

Configuration over code

Secure and sovereign

One record, live

Business outcomes

Board & CEO

Finance

Operations

Procurement

Logistics

Real estate & construction

People & HR

IT & security

Auditors, partners & regulators

The Core & AI

Anatomy of an AI-assisted transaction

Intent expressed

Identity and authority resolved

Work planned across modules

Modules execute

Approval under Delegation of Authority

Committed, audited, notified

Identity & access

Workflow & approvals

Organisation master data

Documents & requests

Tasks & scheduling

Audit & enterprise search

Embedded AI, governed by design

How MCP connects modules and AI

One sentence, four modules, one approved order

Why this architecture matters

Intelligence in every module

Intelligent & semantic search

Natural-language filters

Meaning, not keywords

Across every module

Permission-aware

Ask in your own words, in Arabic or English

Local AI for every module, through MCP

The right model for each task, and no data leaves

AI decision engine for approvals

Every approval arrives with its evidence

Dynamic report builder

Describe the report. It builds itself.

Responsible AI & governance

Same permissions as the user

Human in the loop

Explainable results

Policy per module and action

Complete AI audit trail

Aligned with recognised frameworks

Dynamic workflows

Visual process designer

Event triggers from any module

Dynamic routing by DOA

Sequential & parallel approvals

SLAs, reminders & escalation

Cross-module actions via MCP

AI-assisted steps

Versioning, simulation & audit

Leave request, routed dynamically

The same engine, across every module

Routing by Delegation of Authority

DOA as versioned data

Positions, not people

Conditions on any field

Proof for auditors

One workflow, the right approvers every time

Business modules

Lead-to-cash

Enquiry received

Lead qualified

Proposal issued