AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
An AI chief of staff should never move money, reply to customers in the business's name, accept terms, file returns, change another agent's limits, hide items it cannot place, or present a claim without a source. It reads every part of the business, which is exactly why it should act on none of it. Its job is to route, hold promises and bring decisions to a person.
The chief of staff is the one agent in a business that sees everything: cash, pipeline, complaints, deadlines. That breadth is what makes it useful, and it is also what makes its limits the most important in the system. An agent with wide sight and wide powers is a single point of failure.
The principle: wide sight, no hands
The OWASP GenAI Security Project names three root causes of excessive agency in AI applications: excessive functionality, excessive permissions and excessive autonomy. It notes that in multi-agent systems a compromised or malfunctioning peer agent can trigger damaging actions, and that triggers include ordinary model errors as well as deliberate manipulation such as prompt injection. A coordinator that cannot execute closes off most of that risk: if its reading goes wrong, the result is a wrong suggestion that a person or another agent checks.
Seven things it should never do
| Never | Why | Who does it instead |
|---|---|---|
| Release or move money | A misreading becomes a loss | Finance agent, below its ceiling; a person above |
| Reply to customers as the business | It could promise what nobody agreed | Customer Support, from your policy |
| Accept prices or terms | Commits the business legally and commercially | Sales inside its band; the owner outside |
| File returns or submissions | Regulatory consequences | Compliance prepares; a person submits or approves |
| Change any agent's mandate or ceiling | It would be setting its own rules | The owner, recorded |
| Hide or drop items it cannot route | Silent gaps are where problems grow | It shows them to a person |
| State something without a source | You cannot check it | Every line cites its origin |
Why "just this once" is the danger
The pressure to widen a chief of staff's powers comes from convenience. It already knows the supplier invoice is due and the owner has approved it in the brief, so why not let it release the payment? Because the moment it can, every input it reads becomes a possible instruction. An email that contains text crafted to look like an instruction is a known attack on AI systems, and a coordinator that can act is the most valuable target in the business.
Payment fraud shows why. Action Fraud, the UK national fraud reporting centre, describes mandate fraud as criminals pretending to be an organisation you pay and asking you to change the bank details. A chief of staff that reads such an email should route it to a person. One that could act on it might simply update the record.
Signs an agent has too much power
- It can send email from your address or the company's main address.
- It holds payment credentials or API keys for your bank.
- It can edit the rules or limits of other agents.
- It has no list of refusals, which usually means it refuses nothing.
- You cannot see, after the fact, what it did and why.
If any of these apply, the fix is usually to move the power, not remove the work. Payment credentials belong with a finance agent that has its own ceiling. Sending rights belong with a support agent that answers from your policy. The chief of staff keeps the reading and the routing.
What it should do instead
Limits are only half of the design. Inside them, a chief of staff should be thorough: read every function, join related items, keep the promises register current, rank decisions by what they cost to leave waiting and show its refusals. Being unable to act is not the same as being passive. It should be the first to notice that a promised delivery clashes with a stock shortage, and the first to tell you.
Its refusals deserve attention too. When it declines to route an item because no agent's mandate covers it, that refusal should appear in the brief with the item attached. A pattern of refusals of the same kind is useful information: it usually means the business has a new type of work that needs an owner.
A worked example
Example only. A London e-commerce business's chief of staff reads an email that appears to come from a courier: "Account updated, please pay outstanding £6,200 to the new details below." It does not pay, reply or update anything. It routes the item to Finance flagged as a bank-detail change, which Finance refuses to act on, and raises it to the owner in the brief. The owner calls the courier on a known number and learns the email is fake. Nothing was lost, because nothing could have been. The refused item, the routing and the owner's decision are all on the record, which helps if the business needs to report the attempt.
Where Pryme fits
The Pryme Chief of Staff reads everything, executes nothing, and tells you only what you must decide. Nothing in its scope moves money, answers a customer or files a return. Agents are built and certified on Pryme Intelligence, and every action is recorded with its source. Read more on whether AI is safe with your money or see Pryme security.
Questions people ask
Is an agent that cannot act still useful?
Yes. Most of an owner's overload is reading, sorting and remembering, which is exactly the work a coordinator does.
Can I give it more power later?
You can, but do so one recorded change at a time and ask whether a doing agent with its own ceiling is the better home for that power.
What if it reads something confidential?
It should only read what its mandate allows, and its output should go only to people entitled to see it.
How do I know it is keeping to its limits?
Check the record of its actions. If it executes nothing, the record should show only reads, routes, refusals and reports.
Sources
- OWASP GenAI Security Project: LLM06 Excessive Agency · accessed Oct 2026
- Action Fraud (UK): Mandate fraud · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.