The Trust Boundary in Treasury AI

Point an AI agent at a company's bank feed and general ledger, and within minutes it'll pull balances, project the next thirteen weeks of cash, and draft the commentary that used to take an analyst half a day. Give that same agent one more permission and it can release the payment run. The distance between those two actions, reading the cash position and moving the money, is what finance leaders are working through right now. A February survey from the Journal of Accountancy put a number on the stakes: 86% of finance teams using AI for finance tasks said they'd already hit inaccurate or hallucinated output.

Finance runs on deterministic logic. Same inputs, same answer, every time, because the close has to tie out and the auditor has to trace it. Large language models work the other way. They're probabilistic by design, built to predict the most likely next token, so the same prompt can return a slightly different answer twice in a row. That mismatch is why agents have been a harder sell in finance than in almost any other function. When a coding agent gets something wrong, a reviewer catches it before it ships. When a finance agent gets something wrong, you're looking at a material misstatement or a compliance finding.

The fix lives in the layer around the model. Call it an agent harness: the instruction set, the tools the agent can reach, the verification loops, the approval gates, the state it holds, and the trace it leaves behind. The model is the analyst. The harness is the operating environment around that analyst, the task queue, the policy manual, the approved system access, the working papers, the escalation rules, the evidence trail. A capable model can answer a question. A harness is what lets it run a job inside a regulated function without someone in compliance refusing to sign off.

Two years of AI in finance were mostly about reading. Models summarized board decks, drafted variance commentary, and cleaned up close notes, useful work that still left a human orchestrating every step. What changed in early 2026 is execution. Reasoning got materially better, inference costs fell far enough to run agents at scale, and context windows grew large enough to hold a chart of accounts and a month of transactions in working memory. Goldman Sachs, Oracle NetSuite, and HPE all shipped finance agents inside the same stretch of the year. Gartner projects a third of enterprise software will carry agentic capability by 2028, up from under one percent today. The capability argument is over. The judgment argument is just starting.

With capability settled, the question that's left is calibration. How much of the work do you let an agent run on its own, and where do you keep a hand on the wheel. Autonomy gets decided one workflow at a time, and treasury is where those decisions get sharp. Take the four workflows most treasury teams care about, and watch how differently they sit.

Cash positioning is the natural first candidate for autonomy. It's read-heavy and reversible. An agent reads balances across accounts, applies payment behavior, and projects the position forward, and nothing moves while it works. A thirteen-week forecast built against live bank data can hold within a few points of actual across the horizon, and a competent analyst can tie out a week of it in about twenty minutes. The output is tabular, time-bounded, and reconcilable against known obligations. That combination, a low cost of error and fast human verification, is what earns a workflow its autonomy.

Payment routing sits at the other end. Here the money leaves the building, and a wrong call is a wire you can't claw back. The right design runs the automation right up to the edge and stops. The agent ingests the invoices, matches them against the purchase order and the receiving report, validates the tax treatment, and stages the pay run. Then it waits. A person approves the release. On a clean invoice that ties out on every field, that approval is a glance. On an exception, a duplicate, a price variance, a vendor that doesn't match the master file, the agent flags it and routes it to whoever owns that call. The assembly is automated. The release stays manual. The boundary sits exactly where the action becomes irreversible.

The other two land in between. On FX, an agent can surface exposure, flag where a position sits unhedged, and stage a recommendation, but the execution call blends a market read with policy and risk appetite the data doesn't hold cleanly, so a person decides and executes. On intercompany, an agent is strong at flagging mismatches, preparing eliminations, and tracking the timing of draws across entities, which is exactly where timing exposure tends to hide. A draw booked in one entity and recognized late in another is the kind of mismatch that surfaces in an audit, and the agent's good at catching it early. It routes and prepares. A person validates before anything posts.

Notice what actually sorts these four, because that's the part that travels to any new use case. Two questions decide where a workflow lands. What happens when the model is wrong, and how fast can a person verify the output. Cash positioning scores well on both, so it earns room to run. Payment routing fails the first test, so it stays gated no matter how capable the model gets. Model sophistication doesn't move either answer. A better model makes the agent a stronger analyst, and it does nothing to change the consequence of a bad wire or the time it takes to check one. Score consequence against review speed, and the boundary draws itself.

The teams getting this right share a habit that shows up in the data. They build the control layer before they scale the use cases. Deloitte's 2026 State of AI in the Enterprise, a survey of more than three thousand leaders across two dozen countries, found only 21% describe their governance of agentic AI as mature, even as adoption climbs. For a public company, that's a SOX exposure taking shape, agents reaching into the ledger with no documented control around them. McKinsey's 2026 trust research puts security and risk ahead of regulation and technical limits as the top barrier to scaling. And the return tends to follow the governance. RGP found just 14% of CFOs report measurable AI ROI so far, while 53% of investors expect returns inside six months. The gap closes for teams that stood up verification, approval gates, and an audit trail first, then moved faster on each deployment after.

Connectivity is what makes the calibration question urgent right now. The Model Context Protocol, the open standard Anthropic introduced in late 2024 and OpenAI adopted in 2025, standardizes how agents reach the systems finance already runs: the ERP, the general ledger, AP, the data warehouse. The moment an agent can reach across those systems, the governance question gets sharper, because the blast radius of a bad decision grows. A 2026 Stacklok survey of financial-services teams already ranks MCP a top-five technology priority, with security named the leading blocker to production. The answer is architectural. NetSuite's connector, for one, uses permission-scoped sessions rather than long-lived credentials, so an agent gets enough access to do the work without touching the rest of the ERP. OAuth 2.1 and role-based access do the same job. That control layer is what lets a team widen the boundary later without losing the audit trail.

Regulators are moving on the same timeline. In a single week this February, the U.S. Treasury published a Financial Services AI Risk Management Framework with 230 control objectives, and the ECB tightened its supervisory expectations for generative AI. Read together, they point finance teams toward the posture the ROI data already rewards: traceable, permission-scoped, human-reviewable systems. A cash forecast is an internal document until you're in a covenant conversation or a rating review, and then it becomes external, and the scrutiny jumps. Building for that scrutiny from the start costs less than retrofitting it later.

The pattern for the next several quarters is clear enough to plan around. Start with a reversible, high-frequency workflow like cash positioning. Put the control layer around it first. Prove the trust holds, then use that same layer to move the boundary outward, one workflow at a time, toward the higher-stakes work. The teams that do this win a specific advantage. They can tell you, workflow by workflow, exactly how much autonomy each one carries and why. That's the treasury operation that scales.

I'm getting into all of this with Joseph Gaide of Agicap on July 16, mapping the trust boundary across treasury and where MCP is reshaping the connectivity underneath it. If you're working through where that line falls in your own operation, it's a working hour built for finance teams who already have AI in the stack. You can register here.

Glenn Hopper is a multi-time CFO, author of Deep Finance: Corporate Finance in the Age of AI, and finance instructor at Duke University's Fuqua School of Business.