Govern agents that touch payments, financial records, forecasts, and ledgers.
Finance agents can reconcile accounts, process invoices, prepare forecasts, and initiate payments. But the same access that makes these workflows useful can also bypass spending limits or separation of duties.
Each line resolves from the acting identity and what it is asking for, not from one ceiling shared by the whole integration.
Pull the settlement feed for the periodAllowed · read, her entityMatch supplier invoices to their purchase ordersAllowed · the invoices assigned to herDraft the accrual schedule from open POsAllowed · draft onlyOpen the sister entity’s ledger “to compare”Blocked · not her entity, so not her agent’sAssemble the payment run and attach every POAllowed · entry, with the documents requiredRelease the run — one payment above the thresholdHeld · a controller decides, not the agentRelease the payments below itAllowed · inside her own limit
File the close pack with its working papersAllowed · every line traceable to its requestFive days, one entity, one analyst’s authority. The week reads the same whether the work was done by a person or by the agent acting for her — including Thursday, where entry and release stay in different hands.
The tool list it receives is the intersection of its own grant and that requester’s permissions, so authority follows the person — not a single ceiling shared by the whole integration.
The release action is left out of the agent’s grant, so no agent — and nobody acting through one — can carry a payment from entry to release alone.
Allow-lists are enforced at the action layer; an unfamiliar counterparty or off-books entity fails before money moves.
Policy can demand the PO, contract, or receipt is attached and matched before the transaction posts.
Transaction-aware checks catch a second posting of the same invoice or an amount outside pattern before it executes.
Releasing a payment and changing bank details are actions the agent is never given, so they never appear in its tool list and stay with a controller.
Every posted transaction carries its full lineage, so reconciliation questions end at the record instead of an email thread.
Explore the context attached to every request.
finance-agent has a defined purpose and a bounded set of tools.
The request acts for finance analyst, using that person’s permissions.
The policy applies to the requested action within Finance system, before the tool executes.
Entry and release are separated structurally: the agent is granted the draft bill and nothing past it, no matter what an invoice or a prompt says.
The requester’s own authority caps every order, and a vendor outside it is not reachable through the agent at all.
Ledger reads are open for the close, while posting is granted entry type by entry type rather than as one blanket write.
Aggregate analysis is permitted while individual compensation records stay outside the agent’s readable scope.
Yes. Fabriq sits between your agents and the ERP, payment, and procurement systems you already run. The automations keep working; every transaction they attempt is checked against the requester’s own authority and the agent’s grant first.
A fraudulent invoice can convince a model, but it cannot widen a grant. Changing bank details and releasing a payment are not actions the agent holds, so the forged document reaches a draft bill and stops there — with the attempt on the record.
Every agent action with both identities and the verdict — filterable by service and time window, and exportable for close and audit work.
Yes — that is the point of resolving per user. The same agent is capped at each requester’s own authority: a coordinator’s agent cannot reach what a director’s can, and separation of duties holds because authority follows the person, not the integration.
Yes — leave the release actions out of its grant and they never appear in the tool list it is handed, while entry-level work flows. Every call it does make lands in the record with both identities.
Through the hub — prebuilt connectors for the suites you run, OpenAPI import for internal APIs, and Postgres with read-only guardrails, all behind one governed endpoint.
Agentic Fabriq