Yes, separation of duties still applies. The rule that one party prepares and another approves exists to stop a single point of error or fraud from completing a sensitive transaction alone. Replacing a clerk with an AI agent does not remove that risk. It changes where the separation sits, and adds new ways to break it unnoticed.
What does separation of duties protect against?
Two things. Honest mistakes, which a second pair of eyes catches before they become losses. And deliberate misuse, which is much harder when it needs two people to cooperate. The classic split is between initiating a transaction, approving it, recording it and reconciling it. No single person should hold more than one of those roles for the same transaction. Our explainer on what segregation of duties is covers the basics.
Neither risk disappears when software does the work. An agent makes mistakes, often consistent ones that repeat across many cases. And an agent can be manipulated, for example by instructions planted in a document it reads. If the same agent can prepare a payment and release it, a single error or a single manipulated input completes the whole transaction.
How does an agent fit into the classic split?
As one party, never as two. The cleanest arrangement is that the agent prepares and a person approves: the agent drafts the payment, the supplier change or the credit decision, and a named person with authority reviews and releases it. This is depth 2, draft, for the release step, even if the agent operates at a higher depth for routine work elsewhere.
As evidence builds, an agent can be allowed to execute some routine work within limits on its own, such as small refunds below a customer's threshold. That is a deliberate decision to accept that a particular low-risk action does not need a second party, the same decision organisations make for people when they set a no-approval limit. It should be recorded as such, with the limit and the evidence behind it.
What must not happen is that the agent ends up on both sides of a sensitive transaction by accident.
Where does separation quietly break?
In places that would never pass a controls review if the worker were a person.
| How it breaks | What it looks like | Why it matters |
|---|---|---|
| Agent acts under a person's login | The agent prepares a payment using the approver's credentials | The record shows the approver did both steps |
| One agent holds both capabilities | The same agent can create a supplier and pay that supplier | A single error or injected instruction completes the chain |
| Configurer is also approver | The person who sets the agent's limits also approves its held items | They control both the rule and the exception |
| Agent changes its own limits | The agent can edit the bounds it is checked against | The check is meaningless |
| Approval inferred from silence | Items are released if nobody objects within a time window | No one actually approved |
The first row is the most common and the hardest to see. If an agent works through a person's account, every action it takes appears in the system's log as that person's action. The separation you designed on paper has collapsed into one identity.
How do you keep separation between people and agents?
Give every agent its own identity, separate from any person, so its actions are recorded as its own. Grant it capabilities, not roles, so it holds only what its part of the transaction needs. Set the approval step as a hold for a named person, not as a notification that someone might read.
Then check the combinations. For each sensitive process, list the steps and who or what performs each. A separation of duties matrix for AI agents puts this into a grid of capabilities against parties, so conflicts show up as two marks in the same row. Look especially for an agent holding two steps of the same chain, and for any person who both configures an agent and approves its held items.
What about separation between two agents?
Splitting a process across two agents can look like separation: one agent prepares, another checks. Be careful. If both run on the same model, read the same sources and were configured by the same team, they share blind spots. A mistake one makes, the other is likely to accept. That is two steps without two independent judgements.
Separation between agents works better for capability isolation than for approval. Giving one agent the power to create suppliers and a different agent the power to pay them limits what a single compromised agent can do. It does not replace a person approving the payment. Our playbook on keeping separation of duties between AI agents covers how to structure this.
Does this extend to the second line?
It does. Compliance and risk teams increasingly use agents to monitor, test and report on first-line activity. If the agent doing the monitoring shares sources, configuration or ownership with the agent being monitored, the second line loses its independence. The same applies if first-line staff can change the monitoring agent's thresholds. A second-line separation checklist for compliance agents lists the points to test.
What is the trade-off?
Keeping separation slows things down. Every hold adds waiting time. Separate identities and narrow capabilities mean more integration work. And in small teams, finding a second person with authority and no conflict can be hard.
The temptation is to treat the agent as a neutral tool and let it span roles a person never could. Resist it. The reasons for separation are about the transaction, not about who performs it. Map every sensitive process your agents touch, mark who prepares, approves, records and reconciles, and look for any row where one identity holds two steps. Each one is a gap to close. The wider structure for doing this is in our guide to agent governance as a bound, not a model.
Questions people ask
Can an agent reconcile transactions it prepared?
It should not be the only party reconciling its own work. An agent can run reconciliation checks, but a separate party should review exceptions and sign off, in the same way a person who posts entries should not be the only one reconciling them.
Is it enough to log that the agent prepared and a person approved?
Only if the log is reliable and each party has its own identity. If the agent acted through the approver's account, the log cannot show the separation even if it existed. Distinct identities are the foundation.
Do small organisations need the same separation?
The principle applies, but the controls can be proportionate. Where a second person is not available, compensating controls such as lower limits, after-the-fact review by an owner or external reconciliation can reduce the risk. Record the decision and the compensating control.