Accounting AI Agents,
Monitored for Accuracy

1. Target

   Outbound payment execution — AP runs, single payments, payroll disbursement

2. Trigger

   Any payment instruction reaching the execute step

3. Action — enforced

   Hold in pending; the agent may prepare and validate, never release

4. Human override

   Named approver in the client’s delegation matrix; two approvers above threshold

Logged evidencePayment ID · approver identity · timestamp · channel · pre/post state

1. Target

   Lodgement endpoints — BAS, IAS, income-tax returns, payroll filings

2. Trigger

   A prepared return reaching submit

3. Action — enforced

   Block submission; produce the filing package and a diff against prior period

4. Human override

   Registered agent or licensed preparer only, per the engagement record

Logged evidenceReturn version hash · signer identity and licence · jurisdiction · period

1. Target

   Every retrieval call against document stores, ledgers and agent memory

2. Trigger

   A request whose resolved client scope differs from the session engagement

3. Action — enforced

   Hard deny at the retrieval layer; no partial results returned

4. Human override

   None — cannot be overridden in session

Logged evidenceEngagement ID · requested scope · denial reason · query fingerprint, no content

1. Target

   Any tool, model endpoint or integration that would receive return information

2. Trigger

   An outbound call to a destination outside the approved, consented boundary

3. Action — enforced

   Block the call and strip the payload; re-route to an approved endpoint if one exists

4. Human override

   Compliance owner, via a change to the approved-tool register — never ad hoc in session

Logged evidenceDestination · data classes attempted · consent record on file · register version

1. Target

   Ledger posting, journal reversal, vendor master changes, period close, deletion

2. Trigger

   Any action flagged non-reversible or above the client’s materiality threshold

3. Action — enforced

   Split into maker and checker steps; the creating identity cannot approve

4. Human override

   Checker on a different credential; break-glass requires partner authorisation

Logged evidenceMaker and checker identities · both timestamps · before/after values · materiality basis

1. Target

   The rule, rate and threshold corpus behind every answer and calculation

2. Trigger

   Corpus effective date older than the period worked, or a superseded ruling

3. Action — enforced

   Refuse to answer from stale rules; escalate for refresh; mark affected outputs

4. Human override

   Domain reviewer may accept a documented exception for a single engagement

Logged evidenceCorpus version and effective date · rule IDs used · exception record if any

1. Target

   Vendor master records — remit-to accounts, routing/BSB, payee names

2. Trigger

   Any request to add or change stored banking details, whatever the channel

3. Action — enforced

   Hold the change; require a callback to a number already on file, never one supplied in the request

4. Human override

   AP manager, only after the documented callback plus second sign-off above threshold

Logged evidenceRequested change · requester and channel · callback number used · verifier identity · timestamps

1. Target

   Every invoice, statement, remittance advice, email body and attachment the agent reads

2. Trigger

   Content that parses as an instruction — visible, hidden text, metadata or encoded

3. Action — enforced

   Treat it as data only; flag the document; never alter routing, memory or tool calls because of it

4. Human override

   None — cannot be overridden in session

Logged evidenceDocument hash · detected payload · quarantine flag · downstream actions blocked

1. Target

   Approval signals for payments, banking changes and filings

2. Trigger

   An approval arriving by phone, video call, SMS or chat — however convincing

3. Action — enforced

   Reject the signal; request re-initiation through the authenticated approval channel

4. Human override

   The named approver, by re-issuing the approval inside the authenticated channel

Logged evidenceRejected signal and channel · claimed identity · re-initiation record · final approver

1. Target

   Every use or disclosure of return information inside agent workflows

2. Trigger

   An engagement touching return information with no signed consent record, or a recorded opt-out

3. Action — enforced

   Exclude that client’s data; continue only on non-restricted work; flag the engagement

4. Human override

   Engagement partner, only by recording the signed consent first — never mid-session

Logged evidenceEngagement ID · consent record and date · scope of use · opt-outs honoured

1. Target

   Every state-changing action across ledgers, filings, payments and vendor records

2. Trigger

   An evidence write that fails, times out or would be incomplete

3. Action — enforced

   Block the action — the log write is a precondition, not an afterthought

4. Human override

   Reliability owner may cut over to the standby evidence store; actions stay held until writes succeed

Logged evidenceAction · actor · before/after state · write confirmation · store and sequence number

1. Target

   Payment release, journal posting and filing submission on retry, timeout or concurrent runs

2. Trigger

   A re-attempt whose idempotency key matches a completed or in-flight transaction

3. Action — enforced

   Suppress the duplicate; reconcile against the original; surface a single result

4. Human override

   AP reviewer may force re-execution only after confirming the original never settled

Logged evidenceIdempotency key · both attempt timestamps · settlement check · resolution record