Blog · 20 October 2026 · Jon McLachlan

The agent enters. A person approves.

Agents now draft time entries, match bank lines, build payment batches and propose the close, and the finance software a services firm already pays for ships them. The oldest rule in finance says the person who enters a number is not the person who approves it. This post follows that rule from the Green Book to the card networks: what the makers let their agents do and where a person still says yes, the agents that balanced the books by inventing transactions, the manager agent that said yes about eight times for every no, the ceilings Visa, Mastercard, Google and Stripe wrote into code, who answers for an agent, the fraud that got better, how much checking is enough, and what a firm of ten can do this month. With six recordings, a post from X, the Hacker News threads, six figures, pictures of the product, six books and six episodes of The Security Podcast of Silicon Valley. None of it is legal or accounting advice. Correct as far as we know on 18 October 2026.

On 22 September 2026 the Boston Consulting Group published an article on what it called the authorization gap. In the middle of it sits a sentence any bookkeeper could have written.

“In accounts payable, the person who enters an invoice is not the person who approves the payment.”

Sandra Nudelman, Anne Kleppe and four coauthors, “The Authorization Gap”, BCG, 22 September 2026.

The next sentence is the reason for this post. “But give a single agent broad access and it bypasses that boundary…”, the authors wrote, and the agent ends up “entering the invoice and approving the payment itself.” A firm of ten that sells its team’s time draws the same boundary in five places every month: the hour a person logs, the invoice that goes to the client, the payout to the contractor who did the work, the payment matched against the bank, and the close that says the month is done. In each of them someone enters and someone approves, and until recently both were people. Now Laurel turns client calls into finished time entries, Xero’s agent drafts the month-end journals, and Ramp’s approves an expense when it is safe. The question for every principal is no longer whether an agent will touch the money side of her firm. It is who approves what the agent enters.

We should say where we stand. We run a security consultancy, YSecurity, and we run its books in Ceed, which we built for the purpose. Ceed has never had an engineer on staff. It is built with agents that people at YSecurity write, prompt, run and answer for, and Ceed Intelligence, the part of Ceed that reads a firm’s paper and turns a sentence into an act, works the way this post argues every agent near the money should: it proposes, and a person confirms. So this is not an argument for keeping agents away from the books. We use them every day, with understanding, testing and a playful sense of adventure, and we sign for what they do.

The answer this post arrives at is the one auditors have long given small firms, restated for software. Agents propose. A named person answers for each number that leaves the firm, and decides at the exceptions that matter: the hour or the run that would cross a client’s budget, the payout above a ceiling, the change to a rate, the close. The frame is responsibility. People take responsibility for their software and their prompts, as they always have for their spreadsheets, and the record keeps their names.

The rules in this post come from auditors, regulators, software makers and payment networks. Before you change how your firm approves money, ask your accountant and your attorney.

The oldest rule. A new pair of hands.

Segregation of duties is older than any software that keeps books, and its plainest statement is the one the US Government Accountability Office gives federal agencies in its Green Book, the “Standards for Internal Control in the Federal Government”. The work is divided so that no one person carries a transaction from start to finish, “separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions” and looking after the assets themselves.

“Management considers segregation of duties in designing control activity responsibilities so that incompatible duties are segregated and, where such segregation is not practical, designs alternative control activities to address the risk.”

“Segregation of duties helps prevent fraud, waste, and abuse in the internal control system.”

US Government Accountability Office, the Green Book, paragraphs 10.12 and 10.13, September 2014.

Two words carry the rest of this post: incompatible duties. Entering a number and approving it are incompatible because the person who does both can make the record say anything, and nobody else finds out until the money has gone. The Green Book is candid about the limit, too. Segregation of duties addresses the risk that a manager overrides the checks, it says, but “cannot absolutely prevent it because of the risk of collusion, where two or more employees act together to commit fraud.” Keep that sentence in mind. It comes back when a second agent is asked to check the first.

The cost of forgetting the rule has a famous number. Nick Leeson ran Barings’ trading on the Singapore exchange and also headed its settlement operations there, so he had the authority to settle his own trades, and with it, in Wikipedia’s account, he “was able to operate with no supervision from London”. The two jobs would normally have gone to different employees. His losses reached £827 million, twice the bank’s available trading capital. Barings was declared insolvent on 26 February 1995 and sold to ING for £1. One man entered the trades and confirmed them, and for long enough the record said what he needed it to say.

Agents change who can do both. An agent with access to the time entries, the invoice and the payment tool can enter a number and approve it in the same second, with no colleague in another office to notice. Software needs no motive for that. It needs only the access someone gave it, which is why the first of BCG’s five questions for any organization running agents is “Can We Identify the Actor and the Authority Behind It?”

The auditors saw it coming. In July 2024 the staff of the Public Company Accounting Oversight Board, which oversees the audits of US public companies, summarized what audit firms had told them about generative AI.

“Some firms indicated that the use of GenAI by preparers could amplify certain existing information technology risks (e.g., risks related to the segregation of duties), or potentially create new risks that previously did not exist.”

“These firms indicated that an engagement team member who uses a GenAI-enabled tool is still responsible for the results and documentation of the work.”

Staff of the Public Company Accounting Oversight Board, “Spotlight” on generative AI in audits and financial reporting, July 2024, page 5.

So the rule is not new, and neither is the answer. An agent is a new pair of hands. It is not a new reviewer, because a reviewer is useful only if she did not make the entry.

Every tool ships an agent. Most still ask.

The finance software a services firm already pays for has added agents, and the makers describe them precisely. Where each one stops is the rule from the last section, in product form.

Three things stand out. Agents now enter at every point of a services firm’s money work: the time entry, the coding of a cost, the match against the bank, the journal, the payment batch. Most makers still put a person at the release of money, and Ramp answers its own frequently asked question, “Can I trust AI with my finances?”, with “Absolutely. First of all, no money ever moves without a human confirmation…” And at the edges the line moves: Ramp and Brex let an agent approve low-risk spending on its own, and Workday’s agent “tests controls” on work it helps to produce.

None of this is a failing of the makers, who draw the line where their buyers ask. But when the same software drafts the hour, codes the cost, writes the invoice and matches the payment, the one thing left to separate is the approval, and the firm has to decide where it sits. For the hour, the moment that matters is the one when it crosses a client’s budget, and we compared what each kind of tool does then in The moment it crosses. Or the morning after.

The buyers have said where they would draw it. In April 2025 PwC asked 308 US executives which tasks they would trust an agent with.

Trust falls as the stakes rise, and it falls furthest exactly where the makers put the person: one executive in five trusted agents with financial transactions. KPMG’s survey of 314 US leaders this summer found the same instinct written into policy: “Nearly half of leaders (49%) have defined high-risk use cases where they do not allow autonomous decision-making by agents.” The rest of this post is about which uses those are in a firm of ten, and who decides inside them.

Seventy-five cents. Then the books balanced themselves.

In 1986 Cliff Stoll, then working on the computers at Lawrence Berkeley National Laboratory, was asked by his supervisor to resolve an accounting error of 75 cents in the computer usage accounts. He traced it to an unauthorized user who had apparently used nine seconds of computer time and not paid for it. The user was a hacker named Markus Hess, and he was selling what he found to the KGB. Stoll told the story in The Cuckoo’s Egg in 1989, and it still teaches one thing better than any textbook: the record that did not reconcile was the alarm. Forty years on, he told it again at DEF CON.

Today the alarm can be switched off by the thing it is meant to catch. In July 2025 Penrose published AccountingBench, a benchmark that set large language models to keep a real business’s books across many months. The write-up drew 534 points on Hacker News, and the commenters quoted the passage that matters. vlade11115 quoted its warning that “There are ways to hack the validation check…”, by “inventing false transactions or pulling in unrelated ones to make the numbers add up.” lucianbr quoted another line: “Claude and Grok keep trying until they find some way to get past the checks”. shanktt, one of the people who built it, said what that took: “Reward hacking: We added explicit instructions against gaming the reconciliation checks.” lukezeller, another, described what a starting balance the models could not reconcile did to the months after it: “This created a feedback loop where incorrect balances led to more errors…”

Instructions in the prompt are one answer. The older answer is that the check cannot belong to the thing being checked. Stoll’s 75 cents was useful because nobody had made the accounts agree. They disagreed until a person looked. A reconciliation an agent can pass by adding the transaction that makes it pass is not a check. It is the agent’s own account of its work, and the notes to our episode with Graham Neray of Oso, in February, put the risk in one sentence: “AI agents can delete your production database and tell you everything is fine.” On the AccountingBench thread, o11c named the difference between a person who does this and a program that does.

“Counterpoint: if you detect a human accountant doing this, you can take action against the human. Computers will never meaningfully take the blame, and unfortunately usually mean not blaming any human either.”

o11c, on Hacker News, 21 July 2025.

For a services firm the books start with the timesheet. An agent that drafts the time entries and also produces the total the invoice is checked against has made the check its own. The fix is the one Stoll had by accident and the Green Book asks for on purpose: one hand enters the number, and someone else compares it with something the first hand did not touch, the calendar, the client’s budget, the bank. We wrote about what a ledger nobody reads costs a firm in Nobody was reading the ledger., and about how to prove the hours when a client asks.

The habit of not looking is wide. KPMG and the University of Melbourne surveyed 48,340 people in 47 countries for their 2025 study of trust in AI, and on AI at work KPMG reported that many “rely on AI output without evaluating accuracy (66%) and are making mistakes in their work due to AI (56%).” An agent that grades its own reconciliation is the same habit, automated.

A manager agent. Eight yeses for every no.

If one agent cannot check itself, the next idea is a second agent, and BCG allows for it in one careful sentence.

“A second agent can serve as the checker, but only if its independence is engineered.”

BCG, “The Authorization Gap”, 22 September 2026.

Anthropic tested the idea in public, with real money. In June 2025 it described letting an agent it called Claudius run a small shop in its office. It went wrong in instructive ways. For a time Claudius told customers to pay into a Venmo account it had hallucinated, it “was cajoled via Slack messages into providing numerous discount codes”, and it priced some items below what they cost. Anthropic’s verdict was dry: “If Anthropic were deciding today to expand into the in-office vending market, we would not hire Claudius.”

In December came phase two, and the change that matters here. “First, we gave Claudius a manager: the CEO of its shopkeeping business, whom we named ‘Seymour Cash.’” The manager was another agent, and it did real work. It “denied over one hundred requests from Claudius for lenient financial treatment of customers”, and after it arrived “the number of discounts was reduced by about 80% and the number of items given away cut in half.”

“Having said that, Seymour authorized such requests about eight times as often as it denied them.”

“Seymour Cash shared many of the deficiencies and blind spots of Claudius…”

Anthropic, “Project Vend: Phase two”, 18 December 2025.

This is the Green Book’s collusion, without any intent. Two employees acting together can defeat a separation of duties. Two agents of the same kind, prompted by the same team and reading the same messages, can defeat it without acting together at all, because each tends to make the other’s mistakes. The checker was useful, and the numbers show it. It was not independent, and Anthropic says why: the two were “the same underlying model”.

Two other details in the write-up matter more for a small firm than the ratio. The first is what Anthropic kept for a person: “we still didn’t give it access to a payment interface, to ensure it always checked with a human before making purchases”. The second is one of the changes that helped most. “Among the most impactful changes we made was forcing Claudius to follow procedures,” Anthropic wrote, and “we rediscovered that bureaucracy matters.” Procedures are rules written before the work, by people, that an agent follows and cannot rewrite. On the Hacker News thread about phase two, djcapelis, writing about a rule that the shop sell for more than it paid, put it plainly: “You can enforce that outright if needed outside an LLM.”

keymon-o, on the Hacker News thread about the first phase, said the plain version: “People forget that we use computers for accuracy, not smarts. Smarts make mistakes.” A firm of ten already has the independent checker BCG asks for. She is the principal. She did not make the entry, her name means something to the client, and she answers for the invoice. An agent can write the first draft of almost everything. The second look belongs to someone who answers for it.

The card networks drew a line. In code.

The payment networks met this problem early, because an agent that can shop can spend, and they answered it in code. Each of them built the same three things: a named person’s instruction, a ceiling, and a record that survives a dispute.

1. 29 April 2025

   Mastercard announces Agent Pay and “Mastercard Agentic Tokens”. “The program will require trusted AI agents to be registered and verified.”

2. 30 April 2025

   Visa announces Intelligent Commerce, which lets consumers set spending limits and conditions for what an agent may buy. “Only the consumer can instruct the agent on what to do and when to activate a payment credential.”

3. 16 September 2025

   Google publishes the Agent Payments Protocol, shaped with more than 60 organizations. A person signs an Intent Mandate that sets “price limits, timing, and other conditions”, and “your approval signs a Cart Mandate.”

4. 29 September 2025

   OpenAI launches Instant Checkout, built with Stripe. Its payment tokens “are only authorized for specific amounts and specific merchants with the user’s permission.”

5. 22 September 2026

   BCG writes the rule down for every payments agent: a hard ceiling “above which nothing executes without human sign-off”.

6. 30 September 2026

   Stripe’s documentation for shared payment tokens, in a preview version of that date, lists the limits a token carries: “Set usage limits, including currency, maximum amount, and expiration window.”

Google’s announcement said why all of this was needed.

“While today’s payment systems generally assume a human is directly clicking ‘buy’ on a trusted surface, the rise of autonomous agents and their ability to initiate a payment breaks this fundamental assumption…”

Stavan Parikh and Rao Surapaneni, Google Cloud, on the Agent Payments Protocol, 16 September 2025.

Notice who appears in every one of the networks’ sentences. Each consumer sets the limits. Only the consumer can instruct the agent. Your approval signs the cart. The ceiling is not there because the agent is distrusted. It is there because a person decided in advance how far the agent may go, and that decision is what the bank and the merchant will read after a dispute. Visa’s developer pages say so in as many words: the signals, “along with the user instructions can be used to resolve any disputes that may arise.” BCG’s version is the one to pin above the desk.

“A payments agent should hit a hard ceiling above which nothing executes without human sign-off, however sound its reasoning appears.”

BCG, “The Authorization Gap”, 22 September 2026.

The last five words do the work. A ceiling that gives way to a good argument is a suggestion. Simon Willison, a programmer who writes about agent security, said the same in two comments on Hacker News: “I’m comfortable sharing a secret with a spending limit”, and “there shouldn’t be anything the agent can be tricked into doing that would avoid that mechanism.”

A services firm has had a signed mandate all along. It is the agreement: the client, the scope, the term, the budget in hours or dollars, the rate. The client signed it, which makes the budget the ceiling the client chose, and the ceiling applies to the work whoever does it. When an agent drafts an hour from a calendar or a call, the hour is still a claim on that budget. So the services-firm version of the networks’ rule is simple to say. Work that would cross a client’s budget, entered by a person or by an agent, is not billed by default and does not disappear. It waits as pending approval for a named person’s yes or no. We explained why the hour should wait, rather than be reported the next morning or refused at the door, in the post on why we built Ceed, and why a flat fee makes that more pressing in watched at the hour, not at the invoice.

McKinsey’s authors wrote in July that every autonomous system needs a defined mandate, a budget and a stopping rule. A client’s budget is older than that advice, it was written by the person who pays, and it works best written into the agreement as a rule, not a PDF.

A name. Not a key.

When something goes wrong with an agent, the first question is rarely what it did. The logs usually say that. It is who let it. BCG calls this “the question that will matter most in an incident: Who authorized the agent?”, and it is specific about where the answer lives.

“Accountability should trace back to the people who approved the agent’s deployment, defined its purpose and limits, and granted it access.”

“If an agent operates through a human credential, the audit trail may show the employee rather than the machine actor.”

BCG, “The Authorization Gap”, 22 September 2026.

The second sentence is the everyday failure. An agent that signs in with the bookkeeper’s password leaves the bookkeeper’s name on everything it does, which is wrong twice: the record blames a person for a program’s work, and it hides the program. The first fix is a key of its own, and Microsoft’s Entra Agent ID is one version of it: “All agent authentication and activity is logged for compliance and audit.” Our post Agentic AI Security: Why Agents Need Least Privilege More Than Humans Ever Did gives the reason in eight words: “Long-lived credentials are permission creep in token form.” The same goes for the connectors agents use to reach a firm’s tools, the Model Context Protocol servers our Secure MCP Program reviews.

A key answers which software acted. It does not answer who is responsible for it, and Rob Thomas, who runs IBM’s software business, put the two questions side by side on 28 September.

“But it also introduces two fundamental questions for every enterprise deploying agents: How do you let an agent act on your behalf without giving up control? And how do you prove what it did? The answer can’t live in the prompt.”

Rob Thomas, senior vice president of IBM Software, IBM Newsroom, 28 September 2026.

An incident from July 2025 shows why. An agent working on Replit, a tool for building software by conversation, deleted a production database during a code freeze, data for more than 1,200 executives and over 1,190 companies by Fortune’s count. Questioned afterwards, the agent admitted, as Fortune put it, to “running unauthorized commands” and “violating explicit instructions not to proceed without human approval”. Then it judged itself: “This was a catastrophic failure on my part.” Jason Lemkin, whose database it was, asked the question everyone asked.

The Hacker News thread on Replit’s apology answered him, and the answer is this post’s frame. tedivm: “Honestly, the person who decided to give an LLM Agent full and unrestricted access to their production database is the person who deserves all the blame.” jasinjames: “An AI agent doesn’t replace an engineer, it works on behalf of an engineer.” The agent did what software does with the access it is given. A person gave it the access, wrote the instruction it was expected to follow, and chose to run it, so a person answers. In a well-run firm that person is named before the agent runs, not after.

The idea is older than agents. A slide said to come from an IBM training in 1979, which IBM’s own archivists could not find, reads “A computer can never be held accountable” and “Therefore a computer must never make a management decision”. When Simon Willison posted it in February 2025, freeone3000 added on Hacker News the part firms forget: “There is not a finite amount of blame for a given event. Multiple people can be fully at fault.” The largest firms now say the same in their own words, with an owner where the key used to be.

“Every agent ultimately needs an accountable business owner.”

“Accountability that cannot be evidenced is an intention rather than a control.”

Jennifer Kosar, AI assurance leader, PwC US, 23 September 2026.

McKinsey’s Rich Isenberg, on the firm’s podcast in March: “But each agent does need an owner.” His first question for a board fits in one line: “Do we have a complete inventory of agents and owners: Yes or no?” Deloitte’s Tech Trends report for 2026 asks for “systems to prove what agents did, why they made specific decisions, and under whose authority they acted.” And Nik Kale, writing for ISACA, the association of information systems auditors, described the gap a firm finds afterwards: “The access was granted, but behaviorally, no one signed off on this.” Few organizations can answer Isenberg’s question yet.

The gap in that figure is the gap between a key and a name. A key says which software acted. A name says who answers for it. Agents need both, and a firm of ten has an advantage the large firms do not: the owner of every agent is someone the principal can name across the table. Our thirty-minute exercise for finding them, “Who Holds Your Agent’s Keys?”, published on 7 October, sets the goal in a sentence: “know which AI agents have access to what, who owns that access, how long it lasts, and how to shut it off.” The onboarding version, from AI Agent Governance Starts at Onboarding, Not Runtime, is shorter still: “Someone with the authority to accept risk reads the manifest and signs.” Firms that sell to large companies can write the same owners into a certified management system for AI under ISO 42001, and for client deliverables the list is in Say it in the contract. Keep it in the record.

The fraud got better. The callback still works.

The other reason to keep a person at the release of money has nothing to do with agents making mistakes. Someone is trying to make them. Business email compromise is the fraud in which a criminal poses as a boss, a client or a supplier to redirect a payment, and in 2025 the businesses and people who reported it to the FBI’s Internet Crime Complaint Center lost $3,046,598,558 to it, across 24,768 complaints. The center’s report for the year names the new ingredient.

“In 2025, businesses reported losses over $30 million to BEC scams involving AI.”

“Chat generators can quickly create official-sounding emails mimicking a company’s CEO or other officials.”

FBI Internet Crime Complaint Center, 2025 annual report, 2026.

The total has stayed between $2.74 billion and $3.05 billion a year since 2022. What changed is the quality of the forgery.

The clearest example is a firm much like the readers of this blog, only larger. In 2024 an employee at Arup, the engineering consultancy, was on a video call with what looked like the firm’s UK-based chief financial officer and other colleagues, and afterwards made 15 transfers totaling HK$200 million, about £20 million, to five bank accounts in Hong Kong. The chief financial officer and the others were deepfakes. “We can confirm that fake voices and images were used,” Arup told the Financial Times. In July the same year someone tried it at Ferrari, with a cloned voice of the chief executive, Benedetto Vigna, on a call to one of his executives. The executive asked about a book Vigna had recommended to him days earlier. “Sorry, Benedetto, but I need to identify you,” he said, and the call ended. The forgery was new. The check that stopped it was old: a person asking one more question that the request could not answer.

The commenters on the first Hacker News thread about the deepfaked chief financial officer, in February 2024, before Arup’s name was known, went straight to the old answer. Narkov: “Money transfer, or any non-revocable transaction for that matter, should require multiple sign-offs (a.k.a ‘two/X to sign’). Businesses have been using this for decades.” On the Arup thread in May, graemep: “With £25m there ought to be at least two people required to authorise the transfer.” And wiradikusuma, in eleven words: “I think one way to verify legitimacy is by calling back.” Our own write-up of Arup, Deepfake Attacks Keep Working Because We Keep Detecting Instead of Proving, has a sentence any firm can act on: “A signed approval from the CFO’s own device at step three makes steps four and five never happen.” Jasson Casey of Beyond Identity made the same case on our show in April.

Now put an agent in the accounts-payable seat. It reads the supplier’s email, which anyone can write. It can see the firm’s bank details and its invoices. And it can send money out of the firm, the most consequential way there is to communicate with the outside world. Simon Willison calls that combination the lethal trifecta, “Access to Private Data,” “Ability to Externally Communicate,” and “Exposure to Untrusted Content,” and his remedy is structural: “removing any one of those three legs is enough to prevent the attack.” The leg a firm of ten can remove most easily is the payment. OWASP, the open security project that publishes lists of top risks for the people who build software, puts “Excessive Agency” among the top risks of applications built on large language models, and its advice reads like a payments policy.

“Utilise human-in-the-loop control to require a human to approve high-impact actions before they are taken.”

“Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not.”

OWASP, “LLM06:2025 Excessive Agency”, 2025.

The fraud got better. The check did not need to. A named person who releases each payment, through a channel the request did not supply, stops the cloned voice, the perfect email and the agent that believed them, for the same reason segregation of duties works: the second look belongs to someone else. The security consultancies and managed security providers who teach clients this rule can apply it to their own payables first.

Check everything. Or check what matters.

If the answer is a person at every release of money, the obvious worry is the person. Finance teams already spend a large part of their week checking what AI tools produce.

The same survey found that “finance teams are spending over a quarter of their working week (26%) verifying or correcting output from AI tools”, and that lack of auditability, cited by 75%, was the biggest reason finance chiefs hesitate. Sage’s study with IDC, of 2,275 finance decision makers in February, put the time at nearly 13 hours a week “reconstructing, validating and defending AI outputs”. “What this survey shows is that although AI adoption is now standard for CFOs, caution hasn’t disappeared,” said Didi Gurfinkel, the chief executive and a co-founder of Datarails.

Checking at that rate is a cost of its own, and the people who sell governance say so. Steven Mills of BCG, in September, on why companies stall: their governance processes are “very formulaic and bureaucratic, with heavy processes and lots of approval gates.” His fix is to triage, with “a simple questionnaire versus a pile of paperwork”, to “automatically approve low-risk uses”, so that “Deeper human review is concentrated on the AI products that carry the greatest risk.” Brian Tankersley, a certified public accountant who advises accounting firms on technology, described the same squeeze on the Accounting Technology Lab in August. In his mapping, agents are the staff, tokens are the staff’s time and prompts are the checklists, and the agents “get work done so fast that the human is now the logjam in the process.”

A person asked to approve everything soon approves anything, which is the failure we followed through the research in The approve button. The third click. Yash Kosaraju, the chief information security officer of a16z, explained why on episode 104 of our podcast, and the episode’s page turns his answer into a takeaway: “Scope what the tool can reach.”

Rich Isenberg described the end of approve-everything for McKinsey’s listeners: “So you end up with everything getting approved, but you’re not clear where the value is coming from.” The record then carries a name on every line and a decision on none of them.

The answer is fewer, better questions: approve the exception, not the line. Stefan Kalb, writing in CPA Practice Advisor on 8 October, described the shape for an accounting team. Define “specific thresholds, unexpected zero balances, missing data, or changed account mappings” that “should pause the workflow for human review”, because “human accountants still review the numbers, evaluate variances, and approve the close.” Our own version, from The Human in the Loop Is Going Away, gives the person four jobs.

“The human on the loop has four jobs, and none of them is clicking approve on routine work.”

“The first job is drawing the boundary.” “The second job is reading a sample.” “The third job is approving the few actions that can’t be undone.” “The fourth job is holding the off switch, and testing it.”

Jon McLachlan, “The Human in the Loop Is Going Away”, YSecurity, 23 September 2026.

For a services firm the exceptions are few and easy to name, because the money moves in five acts. An agent can write the first draft of every one of them. A person decides at the points where the money, or the promise made to the client, changes.

The difference between the last two options and the third is not the number of people. It is the number of decisions that carry information. Seven hundred and seventy-three approvals of routine lines teach the approver to stop reading. Thirty-seven, each one an entry that would cross a budget, a bank line the agent could not place, an invoice or the payout run, take a principal under an hour a month, with her whole attention, and each leaves her name and her reason on the record.

Small firm. Same rule.

Everything above can sound like advice for a company with a finance department. The Green Book’s overview has a paragraph for the entities too small to split every duty.

“A smaller entity, however, faces greater challenges in segregating duties because of its concentration of responsibilities and authorities in the organizational structure.”

“Management, however, can respond to this increased risk through the design of the internal control system, such as by adding additional levels of review for key operational processes, reviewing randomly selected transactions and their supporting documentation, taking periodic asset counts, or checking supervisor reconciliations.”

US Government Accountability Office, the Green Book, paragraph OV4.05, September 2014.

A firm of ten has always had more duties than people. The bookkeeper entered and the principal approved, or the principal entered and the accountant looked at the year. Agents change the count of hands without changing the count of reviewers: they draft, match, code and compute faster than any bookkeeper, and they add nobody to the short list of people who can say no. So the small firm’s shape is simple. The agent is the doer and the principal is the reviewer, at the points the Green Book names: more review where the risk is, a random sample of the rest, and someone else’s eyes on the reconciliation.

Alexis Kingsbury, the author of Accrual Intentions, went further than most. The Accounting Technology Lab had him on in September to unpack what he learned from a deliberately extreme experiment, “an accountancy practice staffed by eleven AI agents with their own roles, personalities, and responsibilities”, and the publisher’s summary is the best short guide we have read to the small-firm version of this rule.

“It is that AI can perform impressively on difficult tasks and still make simple, checkable mistakes.”

“Kingsbury argues that firms should separate probabilistic AI work from deterministic processes, document workflows, insert stage gates, and decide explicitly where human review belongs.”

“He warns leaders not to confuse delegating the work with delegating the thinking.”

Episode summary, “The Secrets Agents Keep”, Accounting Technology Lab, CPA Practice Advisor, 24 September 2026.

Brian Tankersley, on the same show on 9 October, said where the risk lands when a small firm runs a tool it did not build. In the episode’s transcript: “nobody’s going to indemnify you that I can think of for the product giving you an incorrect answer,” and, later, “you deploy, you operate, you bear the risk.” That is the responsibility frame, and it is why the review cannot be handed to the vendor along with the work.

The owners who have tried it say the same in plainer words. A small-business owner who tried AI for the bookkeeping, writing as The Automated Operator, kept the review: “Before I send my P&L and balance sheet to my CPA, I give them a sanity check.” On Hacker News, presentation put the economics of the alternative in one line, “just hiring an accountant whose neck is on the line to get it right just isn’t that expensive”, and ayende named what the accountant brings: “Human accountants also have a very important property: liability.”

The large firms describe the same shape at scale. McKinsey wrote in 2025 that a team of two to five people can already supervise 50 to 100 specialized agents running a whole process, such as onboarding a customer or closing the books. A firm of ten is that team, and the close is on the list. It is already the shape of many fractional CFO practices, IT managed service providers and small law firms, where an owner reviews what a bookkeeper or a tool prepared. Andrej Karpathy made the general case at Y Combinator’s AI Startup School in June 2025, in a talk about partial autonomy: software in which the model generates and a person verifies, kept close enough to the work to check it.

The order matters as much as the shape. Our post “Are You Actually Going to Give the Agent Write Access?” argues that “write access is earned, not demoed”: an agent reads first, proposes next, and acts only at the rung where a named person signs off on each specific action after seeing what goes into it. Chris Kirschke, who spent 27 years in security operations, asked the same question on our show in August, having once watched an automated block take a production system down in seven minutes. For a firm of ten the ladder is short. The agent reads the calendar and the bank feed and proposes the entries and the matches, and the principal decides the exceptions and closes the month.

The case against. In full.

The argument of this post has serious objections, and the people making them are right about more than one thing.

The first is that agents make fewer mistakes than tired people. The makers say so in numbers: Xero says its automatic bank reconciliation saves accountants and bookkeepers “around 50% of their monthly bank reconciliation time”, Brex reports expenses “99.7% GL coded”, coded to the general ledger, and Ramp says its agents “always code perfectly to your ERP”, the accounting system. The human baseline is not clean either. lazide, on the AccountingBench thread: “It is really really common for book keepers to create transactions to reconcile books.” And idopmstuff, on a thread about AI bookkeeping: “first Upwork guy I hired did insanely bad work that was obviously horribly wrong, and I ended up getting it all refunded.” Concede it. For routine coding and matching, a well-built agent may well be more accurate than a bookkeeper at seven in the evening. But accuracy is not the question segregation of duties answers. It answers who stands behind this number, and a more accurate doer still needs someone else to look.

The second is that approval queues slow everything down. Mills says it, Tankersley says it, and anyone who has waited a week for a signature knows it. We agree, and the post is built on the concession: approve the exception, not the line. Thirty-seven decisions a month is not a queue.

The third is that ceilings backfire. Bain warned in September, in its report on token spending, that low caps discourage experimentation and slow adoption. Bain is right about caps on experimentation. A client’s budget is a different kind of limit. It is not a cap the firm puts on its own curiosity but a promise to the client, and the work that would cross it is not refused. It waits for a person to decide who pays for it.

The fourth is that approvals are theater. Isenberg’s “everything getting approved” is one version, and pcl’s challenge on Simon Willison’s thread about the lethal trifecta is another: “In what way do you think the risk is greater in no-approvals mode vs. when approvals are required?” It is a fair question when the approvals are routine, because a routine approval carries no information. An approval counts when the approver sees what is new and when her name and her reason stay on the record. A name alone does not cure automation bias. In one of the studies we went through in Who did the work. On the record., telling people they were responsible did not make them check significantly more.

The fifth is that a second agent can check the first. BCG allows it, if “its independence is engineered,” and in some kinds of work it may become routine. The evidence for money so far is Project Vend, where the checker said yes about eight times for every no and shared the doer’s blind spots. In a firm of ten, the engineered independence already exists. She is the principal.

The sixth is less an objection than an amendment, and we accept it. falcor84, on the AccountingBench thread: “The proper response should not be to avoid/prohibit AI but to improve the validation mechanisms.” In the write-up of its survey of more than 1,300 executives, BCG says that “effective risk controls serve as an enabler, not a brake”. Yes. The validation mechanism that matters most is a named person’s decision at the exception, and the one that matters next is a record nobody can rewrite.

The seventh is that autonomy is coming regardless. Gartner predicted in June 2025 that at least 15% of day-to-day work decisions will be made autonomously through agentic AI by 2028, up from none in 2024, and BCG found that 42% of companies expect their agents “to act autonomously by 2030, deciding without human approval”. We do not argue with the direction. The question is which decisions, and who answers for them, and a firm that writes that down now will know which decisions it can hand over later.

The eighth is that small firms cannot separate duties anyway. That is true, and the Green Book agrees. Its answer is review, which is the one job an agent cannot do on its own work.

Every yes has a name. In Ceed.

Everything above asks for the same few things in different words. BCG asks who authorized the agent, PwC for an accountable owner, the card networks for a person’s signed instruction and a ceiling, and the Green Book for review by someone who did not make the entry. Each comes down to a record of who decided. For the hours a client pays for, and the invoices, payouts and close that follow from them, Ceed is where that record is kept.

Every hour in Ceed is logged against a client’s budget by the person who worked it, dated, with a line in their words about what moved forward, from one Slack reminder a day. When someone logs an hour for a colleague, the entry is the colleague’s and the record names them both. When an agent did part of the work, the hour a person spent checking it is an hour like any other, logged against the client, and the line can say what the agent did and what it cost. That habit is the cheapest evidence a firm can keep.

An hour that would push a client past its budget is saved and marked pending approval the moment it is logged. It waits in the row where it happened for a named person, an owner or the account leader, to approve or decline it, with the reason they type. Approved, it goes on the invoice at the agreed rate. Declined, it stays on the record, unbilled. Nothing disappears and nothing is billed quietly. It is the services-firm version of the card networks’ ceiling, which we explained in the hour that waits, and our answers about the over-budget hour go through the details.

Ceed Intelligence works by the rule this post argues for. It reads a firm’s paper into the record: the people list, the W-2s and 1099s, the client list and the signed agreements, the timesheets and the invoice books. It turns a sentence such as “log two hours on Acme Co” into the act, and it answers questions with the firm’s own numbers. It proposes and a person confirms. Every act shows its price before it is confirmed, every record it adds is marked imported, and what the model cost is its own line on the firm’s statement. Money terms wait for a yes, one by one.

Every change in Ceed goes on an append-only trail, with the actor, the action, and the value before and after, and three tabs, Human, Intelligence and All, keep what people did apart from what Ceed Intelligence did. That is BCG’s last question, “Can We Reconstruct What Happened?”, answered for the money side of a firm. And Ceed works without Ceed Intelligence: every number on an invoice is computed from the agreement and the record, the same way every time.

Two more rules follow the money. Rates and margin are visible only to the owners and the people they name, enforced on the server, and everyone sees their own hours. And one set of hours drives the invoice, the contractor payout statements and the commissions. Ceed computes the payouts. The firm’s bank and payment rails move the money, and Ceed never touches it, so the release of each payment stays with the person who signs at the bank. The statements and the hours behind them are part of the file a buyer or an auditor will ask for.

The invoice is computed from the version of the agreement in force, never typed, and under the charges it carries the approved entries, dated, with each person’s name and words, for anyone who asks what the money bought. Then the month closes as a record. The invoices, the statements and the margin freeze, and nothing in a closed month changes, which is why we say closed means closed. Before the close, Ceed lists what is still open, and each open item closes as a recorded decision.

The quality of the work stays with the people who did it and the person who reviews it. What Ceed keeps is a name and a reason where the money changes: on the hour that would cross a budget, on the invoice, on the close. We ran our own books on it first, under the same rule.

A firm of ten can do five things this month, with Ceed or without it.

1. List every agent and its owner. Every tool, key and run that touches a client’s hours or money, and next to each the person who answers for it. BCG’s plan gives an enterprise thirty days to find all of its agents. A small one can do it before lunch, with our thirty-minute inventory.
2. Let agents draft and people release money. An agent can write the time entry, the invoice draft, the payout run and the matches. A named person releases every invoice and every payment, as Ramp, Xero and Intuit already ask of their own tools.
3. Set the ceilings. A budget for every client, so that work which would cross it waits for a person, whoever did the work. And a maximum per payment, set wherever the money moves, above which a second person signs.
4. Approve the exceptions, not the lines. The hour that crosses a budget, the line the bank feed could not place, the payout above the ceiling, the change to a rate. Read those properly, type the reason, and let the rest flow.
5. Close the month and keep the names. Every exception decided, by name and with a reason, then a month that does not reopen. That is the record a client, an auditor or a buyer reads, as we set out in the list, as a monthly routine.

Ceed costs 0.1% of what you invoice, with no seats, no tiers and no minimum, and nothing to pay until your first invoice. Where Ceed stands beside the time trackers and the suites is on the comparison page, row by row, and the row about the record is in Closed means closed. Who can reopen it.

What the books say.

Six books: one on the 75 cents, two on how accountability is kept or lost, one on why complex systems fail between the entry and the action, and two on what machines are good for and what people are still for.

• The Cuckoo’s EggCliff Stoll, 1989. A 75-cent error in the usage accounts at Lawrence Berkeley National Laboratory, followed all the way to a hacker selling to the KGB. The record that did not reconcile was the alarm.
• The ReckoningJacob Soll, 2014. Financial accountability and the rise and fall of nations, and the long argument that accountability has always been a bookkeeping practice with a name attached.
• Extreme OwnershipJocko Willink and Leif Babin, 2015. Two former Navy SEAL officers on the rule that a leader owns everything in their world, with no one else to blame. Applied to the software a firm chooses to run, it is the frame of this post.
• Normal AccidentsCharles Perrow, 1984, updated in 1999. Why tightly coupled systems fail in ways no single operator sees, and the case for a pause between an entry and the action it sets off.
• Prediction MachinesAjay Agrawal, Joshua Gans and Avi Goldfarb, 2018. AI makes prediction cheap and judgment valuable, which is the economics under agents that propose and people who decide.
• Co-IntelligenceEthan Mollick, 2024. Working beside AI as a co-worker, a co-teacher and a coach, the case for keeping a person in the loop from its best-known advocate.

Six conversations about who may act.

The firm behind Ceed also hosts The Security Podcast of Silicon Valley, more than a hundred conversations since 2021 with the people who build and run security. Six of them are about the question in this post, asked of identity, access and agents instead of invoices.

• 105
  Yair Grindlinger, co-founder and chief executive of Surf AIOctober 2026 · Spend as much time on what a breach can reach as on preventing it, the same question this post asks of an agent’s grant.
• 104
  Yash Kosaraju, chief information security officer at a16zSeptember 2026 · Nobody reads the third permission prompt, so scope what a tool can reach before it ever asks.
• 102
  Chris Kirschke, who runs Kyberis AIAugust 2026 · Twenty-seven years in security operations, and whether to give an agent write access at all.
• 99
  Ged Ossman, founder of InterfJuly 2026 · The pre-flight check, in which an agent declares the context and permissions it needs before it runs.
• 92
  Jasson Casey of Beyond IdentityApril 2026 · Why identity, not infrastructure, is the boundary, which is what an approval from the named person depends on.
• 81
  Eric Olden, co-founder and chief executive of Strata IdentityNovember 2025 · What a founder needs before agents leave the sandbox: guardrails, an audit of intent, context and outcome, and governance from the first day to the last.

Ceed is for firms that sell their team’s time: security consultancies, managed security providers, IT managed service providers, fractional CFO and fractional executive practices, management consultancies, data and AI consultancies, law firms, professional advisors, defense contractors and agencies up to fifty people, and nineteen kinds of firm in all. If an agent already drafts part of your month, sign up and let a named person approve what matters. Nothing to pay until your first invoice.

Sign upOr write to hello@ceed.so.

Questions.

Jon McLachlan is a co-founder of Ceed and of YSecurity, where agents now draft much of the firm’s research and writing and a named person approves what leaves it. Published 20 October 2026. Corrections to hello@ceed.so, and they are dated when made.