If you are the CFO deciding what AI goes inside your finance operation, you are hearing two things at once right now. The people who build this technology are warning in public that it could get away from us. The people selling it sound equally sure of themselves. And you are the person who will have to explain it if something goes wrong.
But your decision does not depend on how that bigger argument ends.
The questions in front of you are narrower. What is this agent allowed to do on Monday morning, inside my operation, with my company’s finances and suppliers? What guardrails can I put in place so decisions balance speed with accuracy and compliance? And who is responsible for ensuring agents perform within those guardrails?
Those questions have answers. The cost of skipping them shows up in the numbers.
The numbers say this is a governance problem, not a capability problem
Gartner predicted last year that more than 40% of agentic AI projects will be canceled by the end of 2027 due to escalating costs, unclear business value, and inadequate risk controls. McKinsey’s latest survey finds nearly nine in ten companies using AI in at least one business function — but only about two in ten have reached the scaling phase with agents. Forrester puts the reason plainly: risk management, not capability, is what’s holding adoption back.
All three point to the same root cause: governance and guardrails. And in my experience, that’s a preventable problem.
Deploying agents means giving software permission to act inside your business, within strict limits. An agent will use every permission it’s given — that’s why those permissions should be a deliberate, audited decision, not a default. The consequences land on your company, not the vendor, which is exactly why the guardrails need to be designed carefully.
Agents operating inside finance should not be free-form. They should perform defined tasks within a clearly established scope, with a named person accountable for the outcome. Those guardrails should be built into the system rather than left in a policy document. Before deployment, each AI capability should be risk-scored and paired with specific mitigations. Material actions should also be logged so the organization can reconstruct what happened, determine why and establish who was accountable. In finance, that level of transparency is essential.
These constraints are deliberate. In this category, I think they’re the only defensible design. The Stop Rogue AI Act, the bipartisan U.S. bill introduced this September, would require companies to verify who built and operates each agent through verifiable identity and provenance, not just a vendor’s word. I agree with that. Organizations should not have to take governance claims on trust. Providers should be able to substantiate them through technical evidence, clear auditability and, where relevant, independent certification against recognized standards such as ISO/IEC 42001.
Three things to demand from any AI agent provider
- A verified inventory. A Harness survey published this month found 77% of organizations believe they hold a complete inventory of their AI agents, while only 44% use tooling that actively finds them. That gap is the exposure.[Text Wrapping Break]
- The limits, in writing. Capability lists are easy to write. Boundaries take engineering — and they tell you how a system was actually built.[Text Wrapping Break]
- Human approval at the commitment points. Approval on everything is theater: it adds cost without adding control. Put it where money actually moves.
What this looks like in practice
None of this should slow an organization down. One company runs procurement across more than 40 countries and roughly $6.5 billion in spend, with eight people in strategic sourcing. They did not hand over the keys: agents handle extraction and validation, people handle judgment and exceptions. Invoice processing efficiency went up 23 times, even as spend grew about 20% year over year.
Right now, a controller somewhere is deciding whether the software can approve invoices below a certain amount without her. She’ll pick a number, watch it for a month, then move it up or down. Thousands of controllers are making that same call. Someone needs to be able to say, “I set that limit, I know when the system must escalate and I can change it.”
I cannot tell you how the bigger argument about AI risk ends. The people raising it are serious, and the risk they describe is real. That is exactly why reassurance from any provider is worth so little right now, mine included. What providers owe customers instead is specifics: what our agents can and cannot do, evidence rather than assurances, and a design where a person is accountable at the point money moves.
The encouraging part is that this already works. In ordinary finance teams, inside defined boundaries, it’s producing shorter cycle times, fewer touches per invoice, more volume absorbed without more headcount, and an audit trail somebody can explain. Agents carrying the load, people spending their time where judgment is genuinely required — that’s the version I’d bet on.
