SOX-aligned controls for AI agents in finance systems

An agent in the ERP can draft — but it should never post, pay, delete, or approve on its own. These policies support SOX ICFR and ITGC controls on the agent channel.

For: Finance and audit owners piloting AI against the systems of record

SOX turns on the integrity of the financial record and the separation between who initiates a transaction and who approves it. An agent with write access to the ERP threatens both: it can post to a closed period, move money, or change a vendor's bank details from a single misread instruction. The controllable version is simple to state — the agent can draft, but never post, pay, delete, or approve — and the gateway is where that line holds.

protect-closed-periods denies edits and voids against posted transactions and closed periods, supporting the anti-alteration expectation behind §802. gate-money-movement caps and gates payments and payroll outside the finance group. guard-vendor-banking denies changes to vendor bank and payment details — the anti-BEC control auditors now ask about. require-human-approval-merge carries the same draft-then-human-approves posture into the ITGC change path for financial code.

The boundary: this covers the agent channel, not user provisioning, access reviews, or the financial-statement assertions themselves. Those stay with your ITGC program and your IdP. What the bundle adds is a demonstrable control that the automated actor cannot unilaterally post, pay, or destroy — plus the decision record proving it. The sox bundle collects the set.