Let the agent see cash and prepare decisions, but keep it out of the approval chain. It reads balances and statements, maintains forecast lines it owns, and drafts the daily cash position and proposed transfers. Executing transfers, dealing in currency or investments, changing beneficiaries and managing bank accounts stay with treasury. The agent is never one of the two approvers your controls require.
What does the connection involve, and who owns it?
A treasury management system pulls bank balances and statements, builds the cash position and forecasts, manages intercompany funding, executes payments and foreign exchange or money market deals, and holds the static data on bank accounts and counterparties. Most of its actions move large amounts of money, quickly, and often cannot be reversed. Why treasury actions are so hard to undo is set out in irreversibility in treasury.
The treasurer owns the system and the agent's grants. Treasury dealers and approvers execute and approve. The financial controller cares about the accounting that flows from treasury activity. The wider finance position is in AI agents for finance: books you can audit.
Which permissions should you grant, and at what depth?
| Action in the treasury system | Depth | Condition | Stays with a person |
|---|---|---|---|
| Read balances and bank statements | 1 | Accounts in scope | Nothing |
| Read forecasts and positions | 1 | Same | Nothing |
| Maintain forecast lines the agent owns | 3 | Labelled as agent-prepared | Overrides by treasury |
| Draft the daily cash position | 2 | Draft worksheet | Treasurer sign-off |
| Propose intercompany transfers or sweeps | 2, held | Always held | Treasury approvers |
| Execute transfers or payments | None | Refused by your limits | Two treasury approvers |
| Book currency or investment deals | None | Refused by your limits | Dealers within mandate |
| Approve any payment or deal | None | Refused by your limits | Named approvers |
| Edit beneficiaries or counterparty data | None | Refused by your limits | Static data team |
| Open, close or change bank accounts and signatories | None | Refused by your limits | Treasurer |
| Change bank connectivity settings | None | Refused by your limits | Treasury systems owner |
The agent's grants stop short of anything that moves money. Treasury systems usually require two people to approve a payment or deal. If the agent held one of those approvals, a single person plus the agent could move money, which defeats the purpose of dual control.
What can the agent do well inside those limits?
Preparation, at speed. Each morning the agent can read overnight statements, compare them with yesterday's forecast, explain the differences, update its own forecast lines from known receipts and payments, and draft the cash position with proposed funding moves for the treasurer to review. That is the work that usually consumes the first hours of a treasury day. The process is set out in letting an AI agent prepare cash positions in your treasury system.
The agent's forecast lines carry a label, so treasury can see which figures came from it and override them. An override is kept against the agent's figure, which shows over time where its forecasting is weak.
The agent can also watch the limits treasury works within: minimum balances per account, headroom on borrowing facilities, and exposure to each bank against the counterparty limits the board set. It reports a breach or a near breach in the morning draft. Deciding how to restore headroom, or whether to move deposits between banks, remains a treasury call.
How do you set it up, step by step?
- Person, treasurer: defines the job and the accounts and entities in scope.
- Person, systems owner: creates a dedicated user with read rights, forecast-line rights and draft rights only.
- Person: confirms the agent is excluded from every approval workflow and cannot be added as an approver.
- Person: sets the agent's limits on the platform to match.
- Agent, depth 1: runs read-only for several weeks, drafting positions outside the system for comparison with treasury's own.
- Attest: replays past days against what treasury actually did.
- Person: enables forecast-line and draft rights when certified.
What stays with a person?
Every movement of money, every deal and every change to who can be paid or who can sign. Also the interpretation: a draft position that shows a shortfall in one entity is a fact; deciding whether to fund it from another entity, draw a facility or delay a payment is a treasury decision with costs and risks the agent does not weigh.
What is recorded for each action?
Every read, forecast update and draft is filed as a verdict with the bounds checked and the one that decided. Refused attempts matter most here. An agent repeatedly trying to execute a transfer suggests its brief or its inputs need investigating. The treasury system's own audit log shows the agent's user making forecast and draft changes only. Any execution or approval under that user is a serious incident.
How do you revoke access?
Withdraw draft rights and the agent returns to reading. Disable the user to stop everything. A certification run that clears no depth drops the agent to depth 1 the same day. Because treasury runs to daily cut-offs, decide in advance who prepares the position if the agent is stopped, and test revocation outside the morning window.
Where does it usually go wrong?
Forecast lines are not labelled. The agent's figures blend with treasury's, and nobody knows whose number was wrong.
Draft transfers look approved. A proposed sweep sits in a status that resembles "ready". Make proposed and approved statuses visibly different.
Statement data is treated as final too early. Intraday statements change. Label positions with the statement time.
Connections widen. Treasury, payroll and payables often share bank data. Keep each connection's grants separate; compare connecting an AI agent to your payroll system. Which finance systems an agent can reach is covered in which accounting systems an AI agent can connect to.
Questions people ask
Could an agent ever execute treasury payments?
In principle, at depth 4, within narrow bounds and with certification evidence. In practice, few treasuries should, because the amounts are large and the actions irreversible.
Can the agent's cash data feed management reporting?
Yes, read-only. Cash figures are one input to preparing management accounts, labelled with their statement time.
What about market data?
Reading rates and prices for valuation is depth 1. Acting on them is a dealer's decision.