AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Segregation of duties means no single actor can start, approve and record the same transaction. With AI agents, apply it twice: between agents, so the one that prepares a payment cannot also approve it or edit the books, and between agents and people, so a person holds the steps where fraud or error would be hardest to undo.
An old control for a new kind of worker
Segregation of duties is one of the oldest ideas in internal control. If one person can create a supplier, approve its invoice, pay it and record the payment, they can also invent a supplier and pay themselves, and nobody would see it. Splitting those steps means an error or a fraud needs two parties to go unnoticed. Internal control frameworks such as COSO's treat this kind of separation as a basic control activity.
Small businesses have always struggled with it, because there are not enough people to split the work. AI agents change that in both directions. They make it cheaper to split duties, because an agent can do one part of a process and stop. They also make it easier to concentrate duties by accident, if one agent is given broad access to everything.
The four duties to keep apart
| Duty | Example | Who should hold it |
|---|---|---|
| Authorise | Approve a new supplier or a payment above the limit | A person |
| Custody | Release funds from the account | An agent below the ceiling; a person above it |
| Record | Post the transaction to the books | A different agent or process from the one that paid |
| Reconcile and review | Match the bank to the books and investigate differences | An agent that did not pay, with a person reviewing exceptions |
The rule of thumb is that the actor who causes money to move should not also be the one who confirms the records are right.
Why one all-powerful agent is a risk
The OWASP list of top risks for applications built on large language models includes "excessive agency": giving a system more functions, permissions or autonomy than its task needs, so that a wrong output or a manipulated instruction turns into a harmful action. A single agent with access to payees, payments, the ledger and the reconciliation can make an error and then quietly "confirm" its own work.
Splitting roles across agents limits the damage. An agent that can only draft payments cannot alter the books to hide one. An agent that only reconciles has no reason to explain away a difference it did not create.
Permissions matter as much as roles. Check what each agent can actually reach, not just what it is meant to do. An agent described as "accounts payable only" that can still edit supplier records or delete journal entries has not been segregated. Ask your provider for a plain list of the actions each agent can take, and remove any it does not need.
A practical split for a small business
- Supplier set-up and bank details: a person. Adding a payee or changing bank details stays with a named person, checked through a known phone number or channel. The NCSC's guidance on business email compromise describes fake requests to change payment details as a common attack.
- Invoice matching: an agent. The agent matches invoices to purchase orders or contracts and flags anything unmatched.
- Payment release: an agent below the ceiling, a person above. See how to set a spending ceiling for an AI agent.
- Posting: recorded automatically from the payment, not keyed separately, so the payer cannot post a different figure.
- Reconciliation: a separate process that compares bank to books and sends differences to a person.
- Review: a person, monthly, reads a sample of released payments and every exception.
Worked example (illustrative)
A US landscaping firm with four staff pays about $40,000 a month to suppliers. Before, the office manager did everything. Now an agent matches invoices and releases payments under $2,000; the owner approves anything larger and every new payee; reconciliation runs separately each morning and sends differences to the owner. When a supplier's "new bank details" email arrives, the agent cannot act on it: the change sits with the owner, who rings the supplier on the number already on file.
What people must still do
AI agents can hold some duties, but not the ones that rest on judgement or accountability. A person should still:
- Decide who the business pays for the first time.
- Approve anything above the ceiling, and any exception the agent cannot match.
- Read the reconciliation exceptions and decide what they mean.
- Review the mandates themselves, because who set the rules is a duty too.
Where there is only one person in the business, the owner holds all the human duties. That is acceptable if the agents hold the routine ones separately and every action is recorded, so a bookkeeper or accountant can check later. For the record-keeping side, see audit trails for AI agents: what to record.
Where Pryme fits
Pryme Business separates these roles by design. The Finance agent holds the cash position, releases payments only below your line and tests controls; it cannot close a step on a difference. The Compliance agent screens counterparties, and a payment to an unverified beneficiary is flagged to it rather than released. The Chief of Staff routes work between agents and executes nothing itself. Every action is recorded with its source.
Questions people ask
What is segregation of duties in simple terms?
It means splitting a transaction so that no single person or system can approve, pay and record it alone. An error or fraud then needs two parties to go unnoticed.
Can two AI agents count as segregated duties?
Partly. Separate agents with separate permissions reduce the risk of one system confirming its own mistakes. But the rules for both were set by people, so a person should still hold authorisation and review.
How does a one-person business segregate duties?
Keep the human steps, such as new payees and large approvals, with the owner, let separate agents or processes hold payment and reconciliation, and have an accountant review the record periodically.
What is "excessive agency" in AI?
It is a risk named by OWASP: giving an AI system more permissions or autonomy than its task needs, so that an error or a manipulated instruction becomes a harmful action.
Sources
- COSO: Guidance on internal control · accessed Oct 2026
- OWASP Top 10 for LLM and generative AI applications (2025) · accessed Oct 2026
- NCSC: Business email compromise - defending your organisation · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.