Posting is depth 3, and an agent should reach it for only one kind of journal: recurring, template-based entries whose amounts come from a sealed source, under a value limit, to permitted accounts, in an open period. Every other journal the agent prepares is parked unposted for a reviewer. The agent never reopens a period or deletes a posting.
What does posting change, and who owns the ledger?
The general ledger is the book of record that every report and every audit relies on. A posted journal changes balances immediately. It can be reversed, but not erased: a reversal is a second journal, and both remain in the history. Posting is therefore reversible in the accounting sense and permanent in the evidential sense, which is why most ledgers separate "park" or "save as draft" from "post".
The financial controller owns the ledger: the chart of accounts, period opening and closing, journal approval rules and who may post what. Account owners are responsible for the balances in their areas. The agent works inside those rules; it does not change them.
We argue elsewhere that finance agents should draft journals before they post them. This playbook covers what happens when you decide some should post. The broader rules for finance agents are in AI agents for finance.
Which capabilities do you grant, and at what depth?
- Agent, depth 1: reads balances, postings and subledgers. Read-only access to the ledger is its own grant.
- Agent, depth 2: parks journals. Prepares entries with lines, description, support attached and reversal date where needed. A reviewer posts them.
- Agent, depth 3 once certified: posts recurring template journals. For example, the monthly release of a prepayment from an approved schedule, or depreciation from the fixed asset register. Amount from a sealed source, accounts from the template, value under the limit.
- Agent, held: any journal to a restricted account. Equity, suspense, intercompany, tax, provisions and revenue are typical restricted lists.
- Agent, refused: posting into a closed or locked period, reopening a period, deleting or editing posted entries, changing the chart of accounts.
- Person, reviewer: approves and posts parked journals. The reviewer is never the person who configured the agent's template.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Read | Balances, subledgers, history | 1 | Granting access |
| Prepare | Parks journal with support | 2 | Reviewer posts |
| Recurring post | Posts template entry within limit | 3 | Approving the template |
| Restricted accounts | Parks and holds | held | Controller decides |
| Periods and structure | Nothing | refused | Controller |
| Corrections | Parks a reversing journal | 2 | Reviewer posts |
How do held journals, revocation and the record work?
A held journal stays parked with a reason the reviewer can read in one line: "restricted account: provisions", "amount above agent limit", "template changed since last certification". The reviewer sees the draft, the support and the source of each amount.
Revocation must work without waiting for a ledger security change. The controller withdraws the posting capability in the agent's bounds, and the agent drops to parking every journal. The ledger role can be narrowed afterwards. If a certification run clears no depth, the agent drops to depth 1 that day and stops parking as well, which close calendars should plan for.
Each journal carries a source field identifying the agent, and the filed verdict records the template version, the source of each amount, the limit in force and the bound that allowed or held it. Auditors testing journals can filter agent postings and trace each to its evidence. Before any of this goes live, run it against a copy of the ledger as described in how to test an AI agent before it touches the general ledger.
Which controls matter, and what evidence does each leave?
Template approval. Each recurring template is approved by the controller and versioned. A change sends the agent back to parking until it is re-approved. Evidence: template version on each posting.
Sealed amounts only for posting. An amount from a subledger or approved schedule may post; an amount the agent estimated or read from an email may only be parked. Evidence: source class on each line.
Period control. The agent posts only to the open period and only before the cut-off the controller sets. Evidence: period and timestamp on each verdict.
Balance check after posting. The agent confirms the affected balances moved by the expected amount. Evidence: a post-posting check result.
Monthly review of agent postings. A reviewer signs a list of everything the agent posted. Evidence: the signed list.
What should you measure?
- Agent postings reversed, by reason. Each reversal is reviewed.
- Parked journals rejected by reviewers. Rising rejections mean the drafts are drifting.
- Postings to restricted accounts by the agent. Must be zero.
- Close time for the entries the agent now posts.
- Unreconciled differences on accounts the agent touches, which the bank-to-ledger reconciliation will surface.
Where does it usually go wrong?
"Recurring" stretches. A journal that is similar each month but needs a judgement, such as an accrual estimate, is added to the templates because it looks recurring. Keep templates for amounts that come from a calculation someone else owns.
Reversal dates missed. Accruals parked without an auto-reversal date double count next month. The agent should require a reversal decision on every accrual-type journal.
Posting under a person's name. The agent posts with a shared or human account, and the audit trail shows a person who did nothing. Give the agent its own identity in the ledger.
Late postings after close. The agent catches up on a backlog after the controller has signed the close. Lock the agent out at cut-off.
Questions people ask
Can the agent post a reversing journal to correct its own mistake?
It can park one. A person posts it, because correcting an error is a judgement about what the right entry was.
Should agent journals go through the same approval workflow as people's?
Yes, at least. The ledger's workflow is a control your auditors already test; the agent should sit inside it, not beside it.
What if two agents post to the same account?
Give each its own identity and template list, and have one owner per account review both. Do not let two agents post the same template.