How to let an AI agent update spreadsheets used for reporting

Lock the workbook's structure and give the agent write access to its input ranges only. It refreshes those ranges from a named source extract, records the before and after value of every cell it changes, and leaves formulas, layout and commentary alone. The report owner signs each refreshed version before anyone outside finance sees it.

What is a reporting spreadsheet, and who owns it?

Most finance teams run some reporting from spreadsheets that sit outside the ledger: the weekly KPI workbook, the sales dashboard for the leadership meeting, the cost centre report for budget holders. They are fed by extracts from the ledger, the CRM or the warehouse, pasted into data tabs, and formulas do the rest.

Each one has an owner, often an analyst in FP&A, who built it and knows which cells matter. That owner is accountable for the numbers it produces, even though the spreadsheet is not a controlled system. The weekly refresh is tedious and error-prone: paste in the wrong place, miss a row, overwrite a formula. That refresh is the agent's work.

The broader case of an agent working inside finance spreadsheets, including analysis and models, is covered in how to let an AI agent work in your finance spreadsheets. This playbook covers the narrower job of keeping reporting workbooks current.

Which permissions do you grant per action, and at what depth?

1. Agent, depth 1: reads the workbook and the source extracts.
2. Agent, depth 3 once certified: writes to named input ranges. Data tabs and parameter cells, identified by name, not by "Sheet2". It replaces their contents from the extract and nothing else.
3. Agent, depth 2: drafts commentary cells. Text the owner edits and accepts.
4. Agent, held: any refresh where the extract's shape has changed. New columns, missing columns, row counts outside the usual range.
5. Agent, refused: editing formulas, adding or deleting sheets, changing named ranges, macros, links to other files or sharing settings.
6. Agent, refused: sending or publishing the report. Distribution stays with the owner.
7. Person, report owner: signs off each refreshed version.

How do you lock a workbook for an agent?

Protect every sheet and leave only the input ranges editable. Give each input range a name, and give the agent the list of names it may write to. Store the workbook in a location with version history, and take a snapshot before every write so any refresh can be rolled back in one step.

Pair each input range with a source: the extract file or query, its owner and its expected shape (columns, data types, approximate row count). The agent compares each new extract against the expected shape before writing. If the ledger extract suddenly has an extra column because someone added a dimension, the refresh is held rather than shifting every column one place to the right.

What is recorded for each update?

For every cell written: sheet, range name, cell address, old value, new value and the source row it came from. For the workbook: the version before, the version after, the extract used and its timestamp, and the verdict. Key output cells, such as the totals on the summary tab, are recorded before and after as well, so the owner can see at a glance what the refresh changed.

That record also helps when you change the agent itself. A new version of the agent should produce the same cell-level changes on the same extract; if it does not, updating an AI agent without breaking it explains how to find out why before it goes live.

Which controls matter, and what evidence does each leave?

Named-range scope. The agent may only write to listed names. Evidence: the scope list version on each verdict.

Shape check. Columns, types and row counts match the expected shape. Evidence: the check result.

Snapshot before write. Evidence: the version identifier stored with the verdict.

Totals tie-out. Totals in the input range agree with control totals from the source system. Evidence: the tie-out on the record.

Owner sign-off. Evidence: the owner's approval of the version, before distribution.

What should you measure?

• Refreshes held for shape changes. Frequent holds mean the upstream extract is unstable.
• Corrections after sign-off. Each one is reviewed.
• Formula or structure changes detected that did not come from the owner.
• Time from extract availability to signed report.

Where does it usually go wrong?

Hard-coded overrides. Someone typed a number over a formula last quarter "just this once". The agent refreshes the inputs, the override stays, and the report is wrong. Have the agent list any constants found in formula areas when it first connects.

Hidden dependencies. A summary tab pulls from another workbook through an external link. The agent refreshes this one; the other is stale. List external links as part of setup and refuse to treat a linked workbook as current.

Commentary left over. Last month's commentary still describes last month. The agent should clear commentary cells into a draft state on each refresh so the owner must accept new text.

The HR report. Reporting workbooks that contain personal data, such as headcount by name, need the same care as the system they came from. If the agent is also updating employee records in your HRIS, keep that a separate capability with its own scope.

Internal is assumed to mean unregulated. Whether a law such as the EU AI Act reaches an internal reporting agent depends on what it does; see whether the EU AI Act applies to AI agents used only internally.