Skip to main content

Intelai

Agentic AI in Finance Breaks the Two-Person Control

Every real financial control assumes two people. An agent with a login and a payment permission is one actor with none of the accountability.

By Amyn PorbanderwalaApril 1, 20255 min read

Contents
  1. Where agents actually help first
  2. What the two-person rule is protecting
  3. The controls that make an agent safe around money
  4. The GovCon version is harder
  5. What to tell the CFO

Finance has one control that survives every technology change: two people. The person who requests is not the person who approves. The person who approves is not the person who reconciles. Every auditor, every framework and every internal policy assumes that separation, and it assumes the two people are accountable to a manager, a regulator and a payroll system.

An agent collapses that assumption in a single line of configuration. Give it a credential, give it a payment permission, and it becomes one actor that can request and execute. The model is irrelevant to that problem. The permission is the problem.

Where agents actually help first

The useful work in a finance function is mostly not the transaction. It is the reading around it.

  • Extracting terms from a contract modification and flagging the ones that change a billing rate
  • Triaging a queue of exceptions and routing each to the right specialist with the relevant documents attached
  • Researching a reconciliation break across three systems and writing the explanation
  • Drafting the variance narrative from the actuals, with the source figures linked

None of those move money. All of them consume hours, and all of them are reviewable before the output is used. That is the safe zone, and it is larger than most finance teams assume.

The moment the agent can post a journal entry or release a payment, the question changes from "is the output good" to "who authorized this and can we prove it."

An agent that can approve its own request is not an efficiency gain. It is a control failure with a progress bar.

What the two-person rule is protecting

Segregation of duties is not bureaucracy. It is the cheapest fraud and error detection mechanism ever invented, because it makes collusion necessary. One person acting alone, however senior, cannot both create and conceal a transaction.

An agent with broad permissions recreates the single-actor problem, and it does so while looking like automation. Three failure patterns follow.

The queue approver. A human technically approves every payment, but the agent submits hundreds a day and the human clicks through them. The control exists in the system and not in the behavior. This is the most common failure, and it is invisible in a process diagram.

The shared service account. The agent runs as an account that several systems use, so the audit trail shows the account and not the actor. When something goes wrong, the log answers "the integration did it," which is not an answer anyone can act on.

The reconciliation gap. The agent posts entries, and the reconciliation is also automated, using the same logic. Detection now shares a failure mode with execution. If the agent's interpretation is wrong, both the entry and the check that would have caught it are wrong.

The controls that make an agent safe around money

Four, in order of importance. None of them are model controls.

  1. Dual control outside the agent. The agent may prepare and submit. A human approves, in a separate system, with the full transaction visible. The approval cannot be a notification, and it cannot be batched into a queue that a person clears in ninety seconds.
  2. A ceiling per transaction and per period. A dollar limit the agent cannot exceed, enforced by the system that holds the money rather than by the agent's instructions. Limits are cheap, they fail safe, and they make an error small.
  3. An out-of-band channel for anything unusual. New vendor, changed bank details, amount above threshold. These route to a person through a channel the agent cannot write to. Payment fraud lives in exactly this gap.
  4. Reconciliation that does not share the agent's logic. An independent check, on a different schedule, run by a different owner. If the agent prepared the entry, the agent's rules cannot be the last word on whether it is right.

Add the record: what the agent read, what it produced, who approved, and the policy version in force that day. That is the artifact an auditor will ask for, and it is the argument I make at more length in the agent chain-of-custody piece.

The GovCon version is harder

A government contractor's finance function carries a second layer of obligation. Billing rates have to trace to incurred costs. Timekeeping feeds billing. Subcontractor invoices feed indirect rates that feed every proposal. An error does not just misstate a ledger. It propagates into a submission that an auditor can reopen years later.

That makes the ceiling and the dual control more important, not less, and it adds one requirement: the agent's work has to be reproducible at the rate level. If a billing rate changed because an agent reclassified a cost, someone has to be able to reconstruct why, with the documents, long after the run.

The practical answer is to keep agents out of the cost pool entirely for now, and use them on the evidence around it: reading contracts, checking invoices against terms, drafting the support package a human signs. That is where the hours are, and it is where an error costs a correction rather than a restatement.

What to tell the CFO

Agentic AI will not remove the control that makes finance trustworthy. It will make the control more important, because the volume of actions will rise and the human attention behind each one will fall.

Buy the workflow improvements. Keep the two-person rule. And write down, before the first agent touches a ledger, which permissions it will never have. That list is the most valuable document in the program, and it takes an afternoon.