Balance
Debits must equal credits at the transaction boundary. An unbalanced entry cannot be persisted, so there is no moment where the ledger is temporarily wrong and a later job fixes it.
AI governance
The most important architectural decision in this product is that agents have no write path to the general ledger. They produce a structured proposal; a deterministic engine evaluates it against rules that are code, not context; and only the engine posts. That boundary is why the rest of the automation is safe to run.
What is enforced
Debits must equal credits at the transaction boundary. An unbalanced entry cannot be persisted, so there is no moment where the ledger is temporarily wrong and a later job fixes it.
Open, soft close, closed, or locked — evaluated on every write. Corrections into a closed period become reversing entries in the next open one.
The account must exist, be active, accept postings, and be permitted for that entity. Control accounts reject direct entries entirely.
Configured per account. A posting missing a required dimension is rejected rather than accepted with a blank that quietly breaks reporting later.
The posting actor — human or agent — must hold the permission for this action, in this entity, at this amount. Evaluated at write, not assumed from context.
Entries are append-only. A correction is a new entry referencing the original, and the engine will not accept an edit or a delete from anything.
Not because models are unreliable — they are increasingly good at exactly the work these agents do. Because the reliability is probabilistic, and a general ledger needs a guarantee rather than a high likelihood.
A model that codes correctly 99.4% of the time is genuinely useful and genuinely unsuitable as the last line of defence. Over a hundred thousand postings, that residual is six hundred wrong entries, and the ones that matter are the confident wrong ones nobody reviews. The engine converts a probabilistic proposal into a deterministic outcome: it either satisfies the invariants or it does not post, and that judgement has no confidence interval.
Consider an agent that concludes a bill belongs in a period that closed last week. With a write path, the plausible outcomes are that it posts and quietly reopens a signed period, or posts to the wrong period, or writes an unbalanced entry that a nightly job later corrects. All three have happened in systems that let models write directly.
With the engine in between, the proposal is rejected, the reason is recorded, and the item goes to a human queue. The agent cannot argue, cannot retry under different framing, and cannot escalate. Rejection is terminal for that proposal.
Not a natural-language instruction. A structured object: action type, target records, amounts and lines, dimensions, the policy it believes applies, and its confidence. The engine evaluates that object against your configuration and returns permit, hold-for-approval, or reject.
This matters more than it sounds. Because the interface between the probabilistic part and the deterministic part is a typed object rather than text, the boundary can be tested, versioned, and reasoned about. There is no prompt that produces a different enforcement outcome, because the enforcement layer never reads a prompt.
Honestly: some automation. There are cases where a model is confident and correct and the engine still refuses — an entry into a period a person closed early, a posting to an account somebody deactivated last month. Those become exceptions that a human resolves, and the exception queue is a little longer than it would otherwise be.
That is the trade, and we would make it every time. The alternative is a system where the answer to "could the AI have posted this incorrectly" is "probably not."
Several serious vendors take the same approach and we are not claiming novelty. Others let models write more directly and rely on review to catch errors. It is a fair question to ask any vendor, and the useful follow-up is whether the boundary is enforced in code or described in a system prompt.
Questions
During a demo, ask us to make an agent post into a closed period. It takes two minutes and answers the question properly.