AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
A spending ceiling is the largest amount an AI agent may commit or release on its own; anything above it stops and waits for a named person. Set it per type of payment, base it on what one mistake could cost you, add rules that apply whatever the amount, and review it against the agent's record before you raise it.
What a spending ceiling is, and what it is not
When you let an AI agent pay suppliers, issue refunds or accept a quote, you are delegating authority, not just a task. A spending ceiling is the written limit on that authority: below the line the agent may act and record what it did; above it the agent prepares the item, attaches its evidence and waits. Nothing above the line moves until a person decides.
A ceiling is not a budget. A budget says how much the business plans to spend in a period. A ceiling says how much one actor may commit without asking. Human finance teams have worked this way for decades, and the same logic applies to software that acts. The general principle, that people approve payments within limits matched to their role, is covered in our guide to who should approve payments in a small business.
A ceiling is also not a guarantee. A limit of £500 per payment does not stop fifty payments of £499. That is why a single number is never enough on its own.
Five ways to express a ceiling
Most businesses need more than one limit. The table shows the common forms and what each one catches.
| Limit type | Example (illustrative) | What it catches |
|---|---|---|
| Per transaction | No single payment above £1,500 | One large mistake or one large fraud |
| Cumulative per day or week | No more than £6,000 released per day | Many small payments that add up, including split invoices |
| Per counterparty | No more than £3,000 a month to any one supplier | Overpaying a familiar name, duplicate invoices |
| By category | Refunds up to £150; supplier payments up to £1,500 | Different risk in different kinds of spend |
| By currency | USD payments up to $1,000; FX conversions always to a person | Exchange-rate exposure and unfamiliar rails |
How to pick the number
Start from loss tolerance, not convenience. Ask what single wrong payment the business could absorb without real harm, then set the per-transaction ceiling at or below that. Then look at your own payment history: if most routine payments sit under a certain amount, a ceiling just above that point lets the agent handle the routine while every unusual payment still reaches you.
Worked example (illustrative figures)
A UK design studio pays about 60 supplier invoices a month. Looking back over six months, 48 of them (80%) were under £1,200, and the largest routine payment was £4,800 to its print partner. The owner decides a single mistake of up to £1,500 would hurt but not threaten the business.
- Per-transaction ceiling: £1,500, so roughly four in five invoices can clear without the owner.
- Daily cumulative ceiling: £5,000, so a run of small payments cannot drain the account in an afternoon.
- Print partner: kept above the line on purpose. The £4,800 invoice still reaches the owner each month because it is the largest single exposure.
- Refunds: £100, because refunds go to people the studio cannot always verify.
A Lagos distributor applying the same method might set ₦750,000 per payment and ₦3,000,000 per day. The method matters more than the figure: loss tolerance first, then payment history.
Rules that apply whatever the amount
Some actions should reach a person at any value, because the risk is not in the size. The UK National Cyber Security Centre warns that business email compromise often works by impersonating a supplier or executive and asking for payment details to be changed, and advises checking such requests through a separate, known channel. An agent should never be the party that confirms a change of bank details.
- A new payee, or changed bank details for an existing one.
- A payment the agent cannot match to an approved invoice, purchase order or contract.
- Any payment flagged by screening, such as a sanctions or politically exposed person match.
- Several payments to the same counterparty that together exceed the per-counterparty limit.
- Anything that converts currency, unless you have set a separate FX limit.
Reviewing and raising the ceiling
Raise a ceiling on evidence, not on frustration. Before you lift it, read the record: how many items reached you last month, how many you approved unchanged, how many you rejected and why. If you approved nearly everything between £1,500 and £2,000 without edits, there may be a case for moving the line. If you rejected even one because the agent had the wrong supplier, the ceiling is not the problem.
Review limits at least monthly while you are new to agents, and whenever something changes underneath them: a new bank account, a new supplier base, a change of accounting system. Many owners also lower ceilings temporarily during busy periods, when they have less time to notice an error. For the wider question of which decisions should always stay with a person, see human in the loop: finance decisions a person should make, and our companion piece on segregation of duties when AI agents handle money.
Where Pryme fits
In Pryme Business, the Finance agent releases payments only below the line you set; anything above it stops and waits, with the reason on the item. Every action is recorded with its source. The Chief of Staff brings the decisions above the ceiling to you in its morning brief rather than settling them itself. The ceiling is enforced by the layer the agent runs on, not by a setting the agent can change. You can read how approvals work on how it works.
Questions people ask
What is a good starting ceiling for an AI agent?
There is no universal figure. Start at or below the largest single loss the business could absorb, then check your payment history so routine items fall under it and unusual ones do not. Start low and raise it on evidence.
Should refunds have a different ceiling from supplier payments?
Usually yes. Refunds often go to people or cards you cannot fully verify and are a common target for abuse, so many businesses set a lower limit for refunds than for invoiced supplier payments.
Can an AI agent change its own ceiling?
It should not be able to. The limit belongs in the mandate set by a person and enforced by the system the agent runs on. Treat any tool where the agent can widen its own authority as a serious control weakness.
Do I still need a person to approve payments below the ceiling?
Not one by one, but someone should review the record of what was released, for example weekly. Below-ceiling payments are delegated, not unsupervised.
Sources
- NCSC: Business email compromise - defending your organisation · accessed Oct 2026
- COSO: Guidance on internal control · accessed Oct 2026
- OWASP Top 10 for LLM and generative AI applications (2025) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.