Least Agency in Finance: When Can an AI Agent Act Without Human Review?

For CFOs and COOs, the question is when an AI agent can act without someone checking every item. It needs evidence that errors stay within the business's approved tolerance and are no worse than the process it replaces. High-consequence steps still require human approval. At Celigo, we apply the principle of least agency to finance controls: give each automation only the authority its task requires, then expand it as testing and operating results justify.

The short version

• In our illustrative model, an AI agent checked by a second, independent agent matches full human review on accuracy at about one-thirteenth of the review hours.

• The cost of an error, not the complexity of the task, sets the highest level a step can reach.

• Authority expands only when evidence shows the step meets its approved error tolerance and does at least as well as the process it replaces. A breach returns it to the last configuration that met those requirements.

Why human review is the bottleneck

Most teams start by having an agent do the work and a person review every output. That is a sensible first step, but review effort still grows with volume. In our model, it cuts human time by about two-thirds and stalls there.

In the same model, an independent reviewer agent cuts review time by more than 10x without letting through more errors than full human review. To assess that result in your own operation, start by measuring how often the current process gets it wrong.

AI does not have to be perfect. It has to meet the tolerance the business approves and do at least as well as the process it replaces.

What is least agency?

At Celigo, we apply the principle of least agency to finance controls. OWASP's Top 10 for Agentic Applications, a security-risk framework, includes least agency among its guiding principles. Like least privilege, which limits access, least agency limits an automation's authority to what its task requires. Our finance method puts that principle into practice through five rules:

Use rules where possible. If code can do it (totals tie, balances roll forward, a three-way match), use code. It is cheaper, consistent and testable. Save agents for the parts that need judgment.

Limit judgment to what the task needs. An agent that codes invoices does not need authority to create vendors.

Expand authority based on results. Increase independence only after testing shows the step meets the agreed standard.

Keep authority specific and revocable. Enforce limits in the system the agent runs in, and pull authority back automatically when a threshold is breached.

Keep an audit record. Record inputs, decisions, checks and approvals so anyone can reconstruct what happened.

One workflow can need several levels of oversight. In collections, matching a payment, placing a credit hold and drafting a reminder carry different risks, so each decision gets its own level.

The Trust Ladder: five levels of AI agent autonomy

The Trust Ladder · 5 levels of agency · sample rates illustrative

The Trust Ladder is informed by Kevin Feng, David McDonald and Amy Zhang's Levels of Autonomy for AI Agents (Knight First Amendment Institute, 2025). The level definitions and finance controls are our own application.

A step can move from L1 to L3 after a shadow run demonstrates that L3 meets the approved standard, within the ceiling set for that step. A lower level is not automatically safer, as the next chart shows.

How much review time does a reviewer agent save?

Illustrative model, not company data · 1,000 items a month, 3% agent error rate, people catch 85% of errors in full review

Full human review (L1) takes 33 hours per 1,000 items and lets 4.5 errors through. When the agent flags only its own doubts (L2), review drops to 4.8 hours but 9.6 errors get through, above the tolerance of 6. An independent reviewer (L3) takes 2.6 hours and lets 4.3 through: slightly better than full human review at about one-thirteenth of the time. These results assume the reviewer catches 90% of the preparer's errors. In this model, about 84% meets the tolerance of 6 per 1,000; about 89.3% is needed to match full human review.

For L1 to L4, the chart shows transaction-review time only. It excludes setup, model and platform costs, exception resolution, monitoring and control maintenance. Compare the full cost per completed transaction; the companion post covers those costs.

Which finance tasks can an AI agent handle on its own?

The more an error costs, the less an agent may release on its own. Each step's ceiling is set by the cost of an error and how hard it is to reverse or detect, not by how much judgment the task takes. Releasing a wire takes little judgment and still stays at L1.

Tiers and tolerances are illustrative. Split decisions where risks differ: correcting a vendor address and changing bank details are both vendor master edits, but only one can redirect a payment.

How does an AI agent earn more authority?

Within the ceiling set by the step's consequences, a proposed configuration must meet the approved error tolerance and do at least as well as the process it replaces. Matching an existing process that already exceeds tolerance is not enough.

• Prove it in shadow mode. Run the proposed configuration alongside the current process. Record the decisions it would make, adjudicate errors and keep existing approvals in place.

• Watch it once live. A small sample and planted errors catch drift. They are an alarm, not proof.

• Fall back to the last proven configuration. A breach returns the step to a configuration already shown to meet the approved requirements, usually L1. Changes to the model, data or decision criteria require fresh testing.

The full method, including the scorecard and the evidence each level needs, is in our companion post, The Least Agency Method for Finance Controls.

What does least agency require from your automation platform?

Least agency only works if the limits live outside the agents. No agent, however confident, should be able to waive a dollar limit or skip an approval. The OWASP AI Agent Security Cheat Sheet describes this separation. Your platform needs:

• Rules first. Deterministic flows handle matching, totals and hard limits before any agent is involved.

• A gate before posting. Checks and approvals run before a transaction reaches the ERP, not as an audit afterward.

• Independent checks. The reviewer re-performs the check from source data without seeing the preparer's reasoning, and uses additional sources where possible: the bank, the contract or the customer's remittance. Its effectiveness must be tested on the preparer's actual errors.

• A complete record. Inputs, decisions, checks and approvals are logged for every item.

• Authority you can pull back. A step can return to the last proven configuration without rebuilding the workflow.

This is why we see the connected application stack as the foundation for agents that finance can trust, and why we built the Celigo intelligent automation platform to run deterministic flows and AI agents side by side.

Where should finance teams start?

Pick two or three high-volume steps in the lowest consequence tier, such as expense categorization, cash application matching or invoice coding under a dollar threshold.

Measure the human baseline first: volume, time and full cost per completed item, and errors found later, by severity.

Agree on the tolerance for each step with whoever owns the risk, before any agent runs.

Automate the deterministic parts and put the limits in the execution system before adding any agent.

Start at L1 and run the next level in shadow mode from day one, so evidence builds while people still review everything.

Write the promotion and fallback rules before you need them, and discuss the evidence requirements with your auditors.

Assign a named owner to each control. And give junior staff a way to keep building judgment as routine preparation is automated: rotating through exception queues and control reviews does that.

I used AI to model the economics, draw the charts and critique each draft. Parts of this approach already run in our finance and operations teams; much of it is still being validated. The numbers here are illustrative. I am holding our next stage of automation to the same expectations as any operating process: measurable performance, clear ownership and controls we can test.

Want to pressure-test one of your finance workflows against the Trust Ladder? Email me at [email protected] with the workflow you have in mind, and I'll set up 15 minutes for us to discuss. To see how approvals, guardrails and audit trails work in practice, start with Celigo AI Agents.