AI Financial Agents: What They Actually Do in a Finance Team

The phrase AI financial agent is doing a lot of work in a lot of marketing right now, and most of it describes a chat window with access to a database. That is a useful thing, but it is not an agent in any sense that matters operationally, because it only acts when a human already suspects something is wrong. The whole problem with financial leakage is that nobody suspects anything.

A definition worth using has three parts. An agent runs on its own schedule rather than on demand. It decides what deserves attention rather than answering a question it was handed. And it produces evidence a human can verify, not a summary a human has to trust.

How it differs from rules-based automation

Finance has had rules engines for decades, and they are genuinely good at what they cover. A rule catches the case somebody anticipated: flag any invoice over 50,000 dollars, block a payment where the reference already exists, require two approvers above a threshold. Rules are deterministic, auditable, and fast.

They have one structural weakness. A rule only fires on the pattern it was written for, and the expensive findings are usually a variant of a pattern rather than the pattern itself. An invoice that is 0.4 percent different from an earlier one defeats an exact-match rule completely, and writing a rule for every tolerance band on every vendor is a maintenance burden nobody sustains.

Rules find what you already knew to look for. The residual is where the money is.

What the model layer adds

Language models are good at exactly the part rules are bad at: reading semi-structured text and judging whether two things that do not match literally are the same thing in substance. Applied to an accounting ledger, that means three concrete capabilities.

1. Entity resolution. Deciding that Acme Corp, Acme Corporation, and ACME CORP (AP) are one supplier, which every downstream check depends on.
2. Semantic matching. Recognising that a line reading annual platform license and one reading yearly SaaS subscription describe the same charge.
3. Contextual severity. Ranking a finding by how unusual it is against that specific vendor's history, rather than by raw dollar value.

How to tell a real one from a wrapper

Almost every finance tool now claims an agent. Four questions separate the ones that do something from the ones that added a chat box to an existing report.

1. Does it run when nobody asks it to? If the only way to get output is to type a question, it is a search interface. Useful, but it will never find the thing you did not think to look for.
2. Does it read the whole population or a sample? Sampling is a cost decision dressed as a methodology. Leakage lives in the long tail, which is precisely what a sample misses.
3. Does every output come with its source records attached? If the answer is a paragraph of prose with no transaction ids behind it, you cannot verify it, and an unverifiable finding is not actionable.
4. What write permissions does it hold? The correct answer for an audit tool is none.

A tool that fails the first question is a chatbot. A tool that fails the third is asking for trust it has not earned. A tool that fails the fourth is a risk you are adding to your control environment in exchange for convenience.

Where it should not be trusted

A model is a detector, not an authority. It should never be the thing that decides to move money, and it should never be believed without the underlying records attached. The design rule we follow in Leaki is that every finding carries the transactions it was derived from, so the human reviewing it is checking arithmetic rather than accepting a claim.

The second rule is read-only access. Leaki connects to QuickBooks, Xero, and Zoho Books over OAuth with read scopes and cannot write to your books under any circumstance. An agent that could modify the ledger it audits is auditing itself.

What the workflow looks like

1. Connect the accounting system once, read-only.
2. The agent ingests full transaction history, not a sample, and builds per-vendor baselines.
3. Deterministic audit patterns and model analysis both run against the population.
4. Findings are deduplicated, ranked by severity and recoverable value, and attached to their source records.
5. For anything recoverable, a dispute letter is drafted with the evidence embedded.
6. The agent re-runs as the ledger changes, so a new issue surfaces on its first occurrence rather than its twelfth.

The measure of whether any of this is working is not how sophisticated the model is. It is whether the finance team stops discovering last year's overcharges next year.