An AI agent is an AI system that can take steps on its own, such as reading files, calling tools or sending messages, rather than only answering a question. Guardrails are the limits around those steps. The three that matter most in finance are narrow permissions, approval gates before anything important, and a complete log.
Last reviewed: 17 October 2026. Facts checked. We opened OWASP's LLM06:2025 Excessive Agency page and its LLM01 Prompt Injection page, and NIST's AI Risk Management Framework page. We ran a web search on AI in accounting use cases and controls; results were mostly vendor pages, and we cite none of their performance claims. We did not test any agent product.
What changes when AI can act
A chatbot gives you text. You read it and decide. An agent can do the next step itself: look up a vendor, draft and send an email, update a record, post an entry. That saves time. It also means a wrong answer can become a wrong action before a person sees it.
OWASP's name for this risk is excessive agency. Its page says it enables damaging actions in response to unexpected, ambiguous or manipulated model output. Triggers include hallucination and prompt injection. It names three root causes:
- Excessive functionality. The agent has tools it does not need.
- Excessive permissions. The agent can reach more than its task requires.
- Excessive autonomy. The agent takes high-impact actions without independent checks.
Design the guardrails around those three causes
1. Narrow the tools
Give the agent only the tools the task needs. OWASP suggests preferring narrow tools to open-ended ones. A tool that reads one folder is safer than a tool that runs any command.
2. Narrow the permissions
Use read-only access wherever you can. If it must write, limit accounts, vendors, amounts or time. OWASP suggests running actions in the user's own context with least privilege, rather than using a shared high-power account. It also says to enforce authorisation in the downstream system rather than trusting the model to decide whether an action is allowed.
3. Put approval gates in front of impact
OWASP's page recommends requiring a human to approve high-impact actions before they happen. Its email example is blunt: the user reviews and presses send on every drafted mail.
Decide which actions need a gate.
| Action | Suggested gate |
|---|---|
| Reading a document | None, but log it |
| Drafting a note or email | Person reads before sending |
| Creating a vendor or changing bank details | Two people, outside the agent |
| Posting a journal entry | Approval above a set amount, and for any manual-type account |
| Releasing a payment | Not by an agent in our view; keep the existing payment authority |
| Sending anything outside the firm | Person approves each time |
These thresholds are examples. Set yours by risk.
4. Treat inputs as untrusted
Agents read emails, invoices and web pages. Any of them can carry instructions. OWASP's prompt injection page advises separating untrusted content and applying least privilege. Our post on prompt injection and data leakage gives a checklist.
5. Log everything
OWASP says logging, monitoring and rate limiting do not prevent the problem but limit the damage. For finance, the log is also your evidence. Capture:
- Who started the task, and when.
- The instruction given.
- The model and version.
- Each tool call and its result.
- What the agent proposed and what the person approved or rejected.
- The final change made.
- Any error or stop.
Store logs where the agent cannot edit them.
6. Add a stop button and limits
- A way to halt the agent at once.
- A cap on actions per run and per day.
- An automatic stop on unusual patterns, such as many edits in a short time.
Segregation of duties still applies
An agent is not a person, but it can do the work of one. If the same agent can create a vendor, approve an invoice and release payment, you have broken segregation of duties. Split the roles across different agents or leave some steps to people. Our guide to auditing AI agents covers how reviewers can test this.
Testing before go-live
- Run in suggestion-only mode first.
- Compare its proposals with what a person would do.
- Try adversarial documents.
- Keep the test record. See our LLM test plan.
- Re-test after any model or prompt change.
Who is accountable
NIST describes its AI Risk Management Framework as voluntary and organises work under Govern, Map, Measure and Manage. For an agent, that comes down to a named owner, a written scope, a risk register entry and a review schedule. Use our risk register template and AI use policy template.
What it means for audit evidence
When an agent touches the books, the auditor will want to see the permissions, the approval records and the logs. If those exist, the agent's work can be tested like any other control. If not, the work cannot be relied on.
Frequently Asked Questions
What is an AI agent guardrail?
A limit on what an agent can do, such as narrow tools, narrow permissions, approval gates and logs.
Should an agent ever post to the ledger?
That is a firm decision. If it does, put an approval gate before posting and cap amounts and accounts.
Are logs enough on their own?
No. OWASP says logging limits damage but does not prevent the problem. Combine logs with permissions and approvals.
How do we start?
Begin with a read-only agent that only suggests. Add actions one at a time, each with a gate.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error