The controls that make an autonomous action answerable

Accountability attaches to the grant, not to the action

A named person authorised a class of action up to a ceiling, and that person answers for the exposure they created. Nobody answers for an individual action they never saw, and a control design that pretends otherwise collapses the first time it is used.

The unit of accountability is the grant, and a grant is a document rather than a screen. It names the action type in the vocabulary the audit record uses, the ceiling per action, the aggregate ceiling per period, the conditions under which the authority holds, the person who signed it, the date they signed, and the date it lapses if nobody renews it. That is the same instrument a delegation of authority has always been, and it is enforceable for the same reason: a person with something to lose put their name to a total.

What the grantor answers for is the total, the conditions, and the review. What they cannot answer for is the merit of one action among forty thousand, which is why the ceiling is the real control and the review cadence is the second one. Ceilings are set at the amount the organisation can absorb without recourse, not at the amount the business case assumed, and the two numbers are rarely the same. Where they differ, the business case is the thing that should move.

The common failure is authority acquired by default. A service account created for an integration, holding the right to post journals or release payments because that was convenient during implementation, is an unwritten grant with no ceiling, no conditions and no grantor. Enumerating what the systems already in place can do without asking anybody is usually the first governance task of a programme like this, and it is usually the one nobody wanted to run. The requirement behind all of this is bounded authority, stated there as a property a design either has or does not have.

The record an auditor would accept, field by field

An audit trail for a machine actor is not a log. It is a record produced at decision time, carrying the evidence as it stood, the authority relied on, and the artefact produced, in fields somebody can ask for by name.

The reason a human trail works is that the evidence survives on its own: the invoice, the signed approval, the email. A system reads a position that will not return the same values tomorrow, so the evidence has to be captured as a snapshot at decision time and retained with the decision. A trail assembled later from whatever the source systems still hold is not evidence of what was known. It is a reconstruction, and the difference matters most in exactly the cases somebody is asking about.

A complete record is still not an acceptable one, and two properties make the difference. It is written by the act of acting, so an action that produced no record did not happen and can be reconciled as missing. And it is written to a store the acting system cannot rewrite, because a trail its author can revise answers a different question from the one being asked. Retention runs to the longer of the statutory period for the underlying transaction and the period in which anybody may reasonably query the decision, and policies are versioned instead of edited so that the version reference on an old record still resolves.

The fields below are the minimum. They are what verifiability requires in practice, and a system can be checked against them on a screen in an afternoon.

Segregation of duties without a second person

The four duties are authorise, record, hold custody and reconcile. A system that plans, acts and checks its own work holds all four, and the control has to be rebuilt at the level of the grant and the reconciliation, not the person.

The two person rule was never about the number two. It was about making a loss require collusion, so that no single actor could create an obligation and settle it. When one system raises the order, receives against it and releases the payment, the property is gone at the level of the actor, and the honest position is that it has to be rebuilt somewhere else.

The control that replaces it has three parts, and all three are needed. First, paired grants: the authority to create an obligation and the authority to settle one are separate grants signed by different people, and no single grant carries both. Second, a reconciliation performed outside the acting system, comparing what the system intended against what the record of account shows, running on a schedule the acting system cannot change and suspending an action type on divergence instead of reporting it to a queue. Third, a sampling rate stated as a policy field: a defined share of actions per type reviewed by a person who can reverse them, published in the grant so that the grantor is signing for the review effort as well as the ceiling.

The organisation that says it is too small for this was too small before, and the answer is the one it already uses: substantive review after the fact. What is new is that the review can be cheap and complete instead of a sample, because the decision record exists for every action and can be queried for the conditions worth looking at. That is a better control than the one most small finance functions actually run, which is a second signature applied by somebody who did not see the underlying document.

Confidence limits authority, it does not confer it

A confidence score may bring a person in earlier than the ceiling would. It may never raise a ceiling, widen a grant or extend an action type, and a design in which it does has replaced an authorised limit with a self-assessment.

A score is only a probability if it is calibrated, which means that actions taken at ninety percent confidence turn out correct about ninety percent of the time, measured per action type against outcomes that arrive later. The measurement is ordinary work and almost nobody does it: record the score at decision time, record the outcome when it is known, bucket the pairs, and compare the predicted rate to the observed one. Until that curve exists for an action type, the score displayed beside that action is a number with a decimal point.

So confidence is wired in one direction. Below a threshold, the action routes to a person even though the grant would have permitted it. Above any threshold, nothing changes: the ceiling is where the grantor put it. Evidence age enters the same way, reducing the effective confidence as the snapshot the decision rests on gets older, which matters most for the decisions that look least urgent.

Two failures to watch for. Thresholds tuned to reduce escalation volume, which converts a safety mechanism into a throughput control and is visible as a threshold that moved shortly after somebody complained about queue size. And confidence reported as a single number across action types, which averages a well measured type with an unmeasured one and hides exactly the type worth watching. The calibration curve per type belongs in the pack the grantor sees at review, next to the exposure the grant actually carried, and the standing limit itself stays a matter of bounded authority.

When two agents disagree

Precedence is declared before the conflict, not negotiated during it. Where two grants would both authorise actions that change the same position, neither acts and both positions are recorded in the escalation.

A conflict is not two components arguing. It is two actions, each valid inside its own grant, that together commit the same resource twice or leave a position nobody chose. That second form is the dangerous one because nothing failed: a demand plan reserves capacity to protect a delivery date while a cost programme releases the same capacity to protect a margin, and both are correct against their own objective. The test therefore runs against the combined effect on the record, not against the pair of instructions, and it runs before either lands.

Detection is mechanical, and it is the part most designs leave out. A commitment against a resource is written as a reservation the moment it is decided, before it is posted, so the second decision reads the first one instead of the position as it stood before it. Without reservations, both actions read a true position, both act correctly, and the conflict appears in the record afterwards as a variance somebody has to explain.

The escalation carries what each side was optimising, the action each would have taken, and the joint effect, because a message saying that a conflict occurred asks the reader to reconstruct the trade that the system already had in front of it. It routes to the person who holds both grants, which is usually higher than either function expects, and that is the correct answer, however inconvenient: a trade between two objectives is being made, and the person making it should be the one who owns both.

Reversal, and why a compensating entry is not a deletion

An action sits in one of three states: still inside the system and withdrawable, gone and offsettable, or gone and irreversible. The third state is not eligible for a grant without a person in it.

Withdrawal applies while the action has not left: a queued payment pulled before the file goes, an order cancelled before it transmits. Compensation applies once it has: a second action that offsets the first while both remain visible. Irreversible means there is no second action that restores the position, which is true of anything a counterparty has already relied on and of every physical movement. Knowing which state an action type sits in is a precondition of granting authority over it, and that determination belongs in the grant. An incident review is too late to make it.

The difference between a compensating entry and a deletion is the whole control. A deletion removes the evidence that the first action happened, which breaks reconciliation against every party who saw the original, destroys the record the audit trail refers to, and leaves a position that agrees with nothing outside the system. A compensating entry leaves both actions standing, states the reason, and references the original, so the net position is correct and the history of how it got there is intact. Any system that offers to make an action disappear is offering to make a defect invisible, and the request usually arrives from somebody who means well.

A reversal is itself an action and carries its own record: who or what initiated it, the identifier of the original, the reason, and the artefact produced. Grants carry a reversal window as a field, which for a released payment is measured in hours and for a journal is measured in the open period, and an action type whose window has closed has moved into the third state whatever the grant says. Reversibility is the requirement this implements, and the cost gradient it describes is the one grants should be written against.

What should never be fully autonomous

Three categories, committed to in advance rather than left to judgement. They are stated as categories so that a case nobody has met yet still lands on the right side of the line.

These are not thresholds to be raised as confidence improves. They are places where the decision is not the kind of thing a grant can cover, because what is being decided includes who answers for it. A system may do all the work up to the decision in each of them: assemble the evidence, run the analysis, draft the instrument, and present the recommendation with everything it rests on. What it may not do is be the last actor.