Blog

Tue, 01 Sep 2026 08:02:54 GMT by Silver

A new employee joins the finance team on Monday. Before she approves her first invoice, three things are already in place which have nothing to do with her: a limit of 500 euros on her own judgement, a named approver called Anna above it and a record of every decision she makes. Her name, the amount, the time, the rule. Nobody calls this distrust. She may be the best hire of the year and the controls would be identical, because they were never about her character. They are the price of touching money at all.

Maker-checker

Banks worked this out a long time ago and gave it a name: maker-checker. One person prepares the payment and a different person releases it, and the same identity never does both.

Look at how far the doctrine goes. A payment run contains payments already approved upstream, every invoice checked and every amount signed off. The bank still puts a release control on the batch itself, with limits and a second pair of eyes, before the money leaves the building. Why control something which was already decided? Because systems drift, because files get duplicated and because the gap between deciding and executing is exactly where errors and fraud live. Regulated finance threw out “we approved it earlier, just log the execution” decades ago.

The reason underneath compresses to one line: trust does not scale and evidence does. An auditor never tests intentions, an auditor tests the control, which means the limit, the approver and the record. “Trust me” was never an acceptable answer about money, not even from the most trusted operator in the building.

The details differ in every company and the number on the limit is never the same twice. The pattern underneath does not move. Before a person is allowed to shift company money, somebody sets a limit, somebody signs above it and somebody keeps the record.

The new hire: an AI agent

Now companies are hiring a different kind of employee, and it also starts on a Monday.

AI agents crossed a line in the last two years. They stopped drafting text and started doing the work: closing support tickets end to end, pushing refunds against live orders, moving payment dates, issuing credits. This is not a pilot story. The Swedish pet insurer Lassie now settles 60 percent of its German claims end to end in about six minutes, from a photo of a vet bill to a payout (Lassie raises $75M Series C — Balderton Capital, February 2026). Money out, on unstructured input, at volume. The speed is what breaks the old controls. A support rep closes tickets by the dozen and an agent closes them by the thousand, so any check which depends on a person reading the queue is already dead.

And nobody ran the onboarding.

A prompt and a log

Look at what actually stands between a deployed agent and the bank account. In many production setups today you find two things: a system prompt and an application log.

A prompt is not a limit. A prompt is a request, and it holds right up until a clever customer message talks the agent out of it, or until a model update shifts its behaviour. Machine speed applies to mistakes too, so one honest error can run five hundred times before lunch. A limit which lives inside the agent’s instructions is hope with formatting.

A log is not an audit trail either. The vendor platform writes a diary about its own actions. When the board asks why the system gave this customer 30 percent, the evidence on offer is a database row written by the software which made the decision. In June, Avalara surveyed 1,505 finance leaders at companies already deploying or evaluating agents. Of those, 44 percent were only somewhat confident they could explain an agent’s actions to an auditor or a regulator (Agents of Change — Avalara and Censuswide, July 2026).

Then comes the part no per-agent setting can reach, and it is the one which actually empties the account. Nobody holds the running total. Ten refunds of 400 euros each look reasonable one at a time, and together they are 4,000 euros out of the door before lunch. Put a second agent on a second platform, add an operator clicking inside the payment dashboard, then ask the simplest question in the building. How much left the company today, across all of them? Each system holds its own slice and none of them holds the sum. So the answer gets assembled by hand, or it waits for next month’s reconciliation, which is a strange place to keep a limit.

The same survey asked who carries a significant AI agent error. Six percent answered that no individual or team would be accountable, and a further 17 percent answered that accountability would simply be unclear. Nearly a quarter of the companies already running agents in finance cannot name the person who owns the mistake.

That is the honest state of the art. The fastest employee in the company touches money with a limit it can be talked out of, no named approver and a diary it writes about itself.

Onboarding, for machines

Fixing this does not require inventing anything, because it is the same three controls companies put around people who touch money, moved down to the execution layer.

The constraint attaches to the asset, not to the prompt, and it is enforced where the transaction executes rather than where the agent is configured. The refund object itself carries the numbers: 200 euros in one action, 2,000 euros a day across every actor combined. The agent cannot be prompted out of it because the agent never holds it. When the limit would break, the action fails and the money does not move.

The approval has a name on it. Above the threshold the action stops and waits for a designated human in Slack or in email. The yes is captured and signed as an artifact: this person, this request, this decision, this time. Not somebody clicking something somewhere.

The record is written by a layer with no stake in the outcome. Every decision produces a signed receipt, including the ones that were allowed: the rule that fired, the amounts, the running totals and the approver, if there was one. The agent cannot edit it. Neither can the agent’s vendor, nor the engineering team running it, nor you. An auditor verifies the thing without trusting anybody’s database. That is the whole difference between testimony and evidence.

And one addition humans never needed, because humans are slow: a shared counter, one live daily total across every model, every agent pool and every human dashboard combined. At machine speed the single action is rarely the problem, the sum is. The counter turns your worst day into a number you chose.

What about the platform guardrails?

Yes, your vendor ships them and you should keep them, but those filters govern that vendor’s agent inside that vendor’s own walls. Onboarding was never a per-tool question. The limit, the approver and the record follow the employee into every system they touch. They belong to the company, not to the tooling. The second agent, the partner’s bot and the operator in the dashboard all answer to the same three rules. No platform can give you that by governing only itself. The control has to sit above the tools, for the same reason the person making a payment cannot be the only person approving it.

The Monday test

You do not need a project to find out where you stand. Take every agent in your company which can act rather than draft, and ask three questions.

What is its limit in euros, written somewhere the agent cannot edit?

Who approves the actions above that limit, by name?

What record of its actions exists which the agent’s own platform did not write?

A missing answer is not a scandal. It is an employee who started work with no limit, no approver and no record. Eventually somebody in the building gets asked why.

Originally published in https://stategram.io/blog/your-newest-employee-skipped-onboarding

This is what I build. Stategram gives an AI agent the onboarding people get before they touch money: hard limits on the asset itself, named approvals and a signed receipt for every decision, enforced where the transaction executes. If your agents can act and those three questions came back empty, I want to hear what your setup looks like: stategram.io

Br, Silver

Try out Toolblox