Before an AI agent touches your money

For most of the past two years, the AI questions I got from our finance partners were about reading and writing. Could a model summarize a contract or draft a variance explanation? Lately the question is different. Can an agent match an invoice to a purchase order and route it for payment without anyone touching it? That shift turns AI into a controls question, and the first place it gets serious is anywhere money moves.

Finance is moving faster here than its reputation suggests. More than half of CFOs named integrating AI agents into their departments as a transformation priority for 2026, and in one survey of mid-market finance leaders, nearly four in five said agentic tools already handle at least a quarter of their accounting and finance workload.

The governance hasn’t kept pace. Most of the frameworks enterprises built over the last two years were designed for copilots and chatbots, tools that suggest something a person then decides to do. Agents skip that step. Some 65% of enterprises have already seen an agent act outside its intended scope, and the same research surfaced a telling gap: 94% of respondents were at least somewhat confident their agents held no more access than they needed, yet only about a third provisioned them with least privilege. When something goes wrong, it costs real money. Just over a third of organizations say an AI agent incident has already led to financial losses.

What strikes me is that finance solved this problem a long time ago, for people. Nobody on an accounts payable team can approve their own expense report or release a payment above their limit without someone else signing off, and every change to the ledger leaves a record. Those controls exist because mistakes involving money are expensive and hard to reverse. An agent working inside a financial workflow should inherit the same controls as the people it works alongside, and it should have them before it goes live. In practice, that means four things need to be true first.

The first is identity. Every agent needs its own verified identity, separate from the employee it acts on behalf of. If an agent borrows a person’s credentials, your logs will show that person approving something they never saw, and you lose the ability to tell the two apart when it matters most.

The second is a defined scope. An agent should be able to perform an explicit list of approved actions and nothing else. Think of it as the agent version of an approval limit. It can match invoices under a set threshold, for example, and has to escalate anything above it.

The third is a record that can’t be changed after the fact. Every touchpoint in a transaction, from the original request through to the payment, should be logged in a way that no one, including the agent, can alter. Auditors will ask for it, and so will your own team the first time something looks off.

The fourth is a clean handoff. When a request falls outside the agent’s scope, it should go to a person along with everything the agent already knows, so the human isn’t starting from zero.

At Twilio, agents now take calls for our procurement and treasury teams under these same rules. Each call starts with identity verification. The agent won’t accept banking changes by phone, sending suppliers to a secure portal instead, and it won’t read out full account numbers. Every conversation produces an auditable record, and anything outside scope goes to a person with the full transcript attached.

These controls also need to live in one place. Finance won’t be the only function deploying agents, and if every team builds its own identity scheme and its own logs, you end up with several audit trails and no single answer to the question that matters: which agent did this, and who allowed it? That’s the pattern that turned shadow IT into a decade long cleanup. It’s why I think agent governance belongs with the CIO, with each function building on top of a shared set of controls.

I hold this view knowing the risk cuts both ways for me. If we put too much friction in front of finance teams, they’ll find a way around us, and the agents will get built anyway, just without the controls. If we move too fast, the first time an agent pays an invoice it shouldn’t have, the question an auditor asks is who approved it, and “the agent did” is not an answer I ever want to give. The way through is to build the controls before the agents arrive, so that saying yes to finance becomes the easy part.