Blog
Cornerstones for "what is", "how is X different", and "how do I". Field notes from real pilots. Technical deep-dives for architects. New articles ship roughly every 2 weeks.
The definitional articles. Start here if you're new to the policy-gate pattern.
A practical playbook for AI in the monthly close: where to start, what to automate first, how to keep your SOX 404 controls intact, and the audit-committee narrative that lands.
Read articleThe NIST AI RMF Agentic Profile (CSA 2026) is the newest framework for AI agents in production. Here's how the reversibility tier model applies to finance close, recon, and AP.
Read articleEvery funded vendor in close + reconciliation keeps the policy gate closed-source. Here's the open-source alternative — what it covers, what it doesn't, and how the TCO actually compares.
Read articleA policy gate is the single chokepoint every state-changing AI agent action passes through. Here's what makes the pattern defensible to your audit committee — and why open-sourcing it matters.
Read articleTactical articles for finance teams + architects piloting against real workflows.
SOC 2 Type 2 requires ongoing operating-effectiveness evidence (CC4.2). Here's how to get AI-agent monitoring evidence on autopilot — reproducible JSON, 365-day CI retention.
Read articleEvery state-changing action your AI agent takes lives in one of four tiers (T0/T1/T2/T3). The tier determines the routing — automatic, audit-logged, HITL, or dual-HITL. Here's the model in detail.
Read articleThe Model Context Protocol (MCP) is the emerging standard for AI agent tool surfaces. What an MCP server for finance close + reconciliation looks like, and why it beats custom RPC.
Read articleThe AP 3-way match is the canonical accounts-payable control. Here's how to automate it with AI while preserving the SoD chain (requestor ≠ coder ≠ approver ≠ payer) and the audit posture.
Read articleSetting materiality thresholds for AI agent actions is harder than picking a number. Here's how to think about per-entity overrides, sensitive-account routing, and the audit-committee narrative.
Read articleWhy SoD for AI agents has to be enforced server-side at the transport layer — not at the prompt. The defense-in-depth pattern, the LLM-impersonating-human attack, and the audit-trail evidence.
Read articleReal stories from pilots, plus the technical deep dives.
A real (anonymized) story of an AI agent that auto-confirmed an $87K vendor invoice after a vendor bank-change request. What the controller did on Sunday, and what the audit-committee memo said.
Read articleMulti-entity teams need defensible FX rates per transaction date and reliable intercompany clearing across entities. The Protocol+registry adapter pattern that handles both.
Read article