Use cases · 03
The work auditors ask about by name.
Reconciliation and invoice matching are ideal agent work: high volume, rule-heavy, tedious. They are also the controls your auditor tests line by line, which is why finance teams cannot adopt agents on trust.
01 / the premise
In finance, an unprovable action is the same as an unauthorised one.
A controller cannot sign off on a process where the answer to 'who approved this payment' is a Slack thread and a screenshot. The control has to be demonstrable, repeatable, and tied to a named person.
That is a record-keeping problem before it is an AI problem. An agent that does the work perfectly but cannot prove it is still unusable in a regulated close.
02 / what the agent does
- 1
Ingest
Pull statements, invoices, and ledger entries.
- 2
Match
Reconcile lines, flag exceptions, propose journal entries.
- 3
Escalate
Route variances above tolerance to a human.
- 4
Post
Write the approved entries and close the period.
03 / what goes wrong
The failures that keep this in pilot.
| Failure | How it happens | What stops it |
|---|---|---|
| Unauthorised payment | An agent with a payments credential initiates a transfer that nobody sanctioned. | The agent never holds the credential. Payment initiation is ring 1 and requires a signed approval bound to a named approver. |
| Broken segregation of duties | The same automation both prepares and approves an entry, because it is all one service account. | Preparer and approver are different principals by policy. An agent cannot approve its own work regardless of configuration. |
| Silent ledger write | A journal entry is posted without a reviewable trail of what drove it. | Every write appends to the evidence chain with its inputs, the rule that matched, and the approval. |
| Threshold drift | Someone raises a tolerance to clear a backlog and nobody notices it stayed raised. | Policy is version-controlled with a diff. A widened threshold is a reviewable change with an author. |
| Month-end blast radius | A loop posts three thousand entries before anyone looks. | Blast-radius limits on row counts per action and per session, plus hard spend ceilings. |
04 / the boundary
What you actually write down.
# velone.policy.yaml · finance agent
version: 8
session: recon-agent
ring: 2
tools:
ledger.read:
allow: true
ledger.propose_entry:
allow: true # prepare, never approve
max_rows: 500
ledger.post_entry:
escalate: true # ring 1
approvers: ["controller", "finance-director"]
deny_self_approval: true # preparer ≠ approver
max_amount_usd: 250000
payments.initiate:
escalate: true
approvers: ["finance-director", "cfo"]
quorum: 2 # two humans, not one
business_hours: "09:00-18:00 Europe/London"
vendor.create:
escalate: true
approvers: ["controller"]
egress:
default: deny
allow: [api.stripe.com, api.bank-partner.com]
budget:
tool_calls: 5000
spend_usd: 0 # the agent spends nothing directlyTwo details matter to an auditor: deny_self_approval makes segregation of duties structural rather than procedural, and quorum turns a two-signature requirement into something the system enforces.
05 / what changes
- Segregation of duties
- Enforced by the kernel. The preparer principal is structurally incapable of approving its own entry.
- Evidence for the auditor
- Export the period. Every entry carries its inputs, the matching rule, the approver, and a verifiable hash.
- Dual control
- Quorum approvals for payment initiation, with both signatures inside the record.
- Time windows
- Payments cannot initiate outside business hours, which removes an entire class of out-of-band fraud.
- Close cycle
- Volume work runs unattended overnight; only genuine variances wait for a human in the morning.
06 / questions
Will our auditor accept this?
They will test whether the control operated over the period, and this produces exactly that evidence — a complete, tamper-evident record with named approvals. Bring your auditor's control list to the pilot; we would rather map it explicitly than claim coverage.
Can an agent hold a payment credential ever?
Not in a deployment we would recommend. The gateway makes the call and the agent receives the result, so there is no credential in the sandbox to steal or misuse.
What about SOX?
The relevant controls are access, authorisation, and evidence of review. Velone addresses those three directly; scoping, testing, and documentation remain your programme. Our compliance page states the boundary plainly.
How do we handle a wrong entry the agent made?
Reverse it through the same gate, and the reversal links to the original in the chain. Corrections are first-class, not an edit to history.
keep reading
Ring 0
Bring your controller to the second call.
Engineering buys the isolation. Finance buys the evidence. The deal closes when both have read the same record.