The central design rule
An AI model is useful at interpreting messy evidence and preparing bounded work. It is not a reliable source of financial authority. A controlled system therefore separates five roles that are often blurred together:
| Role | Allowed responsibility |
|---|---|
| Model | Classify, extract, match, explain, rank, draft, and propose within declared limits |
| Deterministic engine | Calculate exact amounts, apply effective policy, validate invariants, and reproduce results |
| Authority service | Evaluate tenant, scope, actor, separation of duties, materiality, approval, and expiry |
| Database | Enforce transaction boundaries, balance, period state, immutability, idempotency, tenant isolation, and audit persistence |
| Qualified person | Make professional judgments, approve material exceptions, certify work, and accept conclusions within their role |
A useful automation ladder
Tier 0: deterministic execution
Exact-match rules, approved recurring schedules, fixed calculations, and fully specified mappings can execute automatically when every invariant passes.
Tier 1: bounded model preparation
The model may produce a suggestion with confidence, evidence citations, policy candidates, and reason codes. Deterministic validation either accepts the bounded result, routes it for review, or rejects it.
Tier 2: human approval
Material, unusual, ambiguous, policy-changing, close-sensitive, tax-sensitive, or high-impact work requires a separate authorized actor. Approval must bind to the exact content being advanced.
Tier 3: professional or external conclusion
Tax filings, audit opinions, regulated attestations, government determinations, and material accounting judgments remain outside model authority. The platform prepares evidence; the authorized professional decides.
Controls that should fail closed
- A model cannot widen its own tenant, entity, book, period, action, or amount scope.
- An approval for one content hash cannot authorize a changed journal, filing, report, or policy.
- A worker cannot turn a closed period into an open one as part of a convenient retry.
- A missing policy version, evidence reference, actor, or idempotency contract creates an exception—not a silent default.
- Provider failure does not make an AI-generated financial conclusion authoritative.
How to make explanations useful
An explanation should cite the source event, evidence, active policy, calculation inputs, prior state, materiality, approval requirement, resulting financial effect, and reconciliation consequence. A fluent paragraph without those anchors is product copy, not control evidence.
What to test before enabling automation
- Run known, ambiguous, adversarial, duplicate, late, cross-tenant, and closed-period examples.
- Confirm exact calculations do not depend on model arithmetic.
- Prove denied actions fail at both the API and database boundaries.
- Verify the model suggestion, human decision, exact content, and final effect remain attributable.
- Measure false acceptance, false escalation, exception age, review time, and reconciliation breaks separately.
Invarent applies this separation throughout its financial control plane. The trust center states where technical controls end and professional responsibility begins.