Ask Nikhil Parambath where autonomy ends for a finance AI agent, and he skips the philosophy. He names a number.
“This is a journal that is like $10. Okay, you go ahead and do it,” says Parambath, regional vice president for Asia at BlackLine, the financial close software company. “So long as you don’t do one every nanosecond.” Above $100, the agent can review the prepared entry but cannot post it to the books. A person with “the final authority” does that.
The numbers are examples, but the design is real. In BlackLine’s model, an agent gets the same setup as a human user: a role, access rights, a materiality limit and segregation of duties (SoD), the rule that stops one actor from both preparing and approving the same entry. Autonomy is not something the AI model has. It is a limit finance sets.
That changes the data integrity question for CDOs. For decades, the test was simple: Does the number tie out? Once software can post the number, three more tests follow. Was the action authorized? Did it stay within limits? Can someone rebuild what happened afterward? A correct balance posted by an agent with too much access is still a control failure.
I put those tests to Parambath. His answers add up to a practical playbook for CDOs, and it starts with speed.
Speed is the new risk
The “fix the data first” rule, Parambath says, “has been true even before” AI. What AI changes is velocity. “Earlier we were in control of the velocity,” he says. Bad data once produced bad reports at human pace. Agents produce them at machine pace, at a scale the “human mind cannot comprehend.”
Markets learned this before generative AI. On Aug. 1, 2012, a faulty software deployment at Knight Capital sent more than 4 million orders in 45 minutes, the SEC’s Knight Capital enforcement action found. Losses topped USD460 million. Before the market opened, 97 automated emails had flagged the error. Knight did not act on them. A financial close platform is not a trading system, but the risk carries over: Automated actions can move faster than the people meant to stop them.
“AI by definition is probabilistic. Finance by definition is a deterministic function.” — Nikhil Parambath @ BlackLine
Most finance teams cannot yet prove they could stop them. In KPMG’s 2026 Global AI in Finance survey of 1,013 senior finance leaders, 75% report active AI use in finance, up from 30% two years earlier. (KPMG notes the question changed between surveys.) KPMG tests readiness by asking whether a firm can produce AI-related audit evidence “efficiently and without disruption.” Only 42% strongly agree. Only 29% formally track where AI adoption fails. That is a blind spot, not a failure rate. Teams cannot fix failures they never record. Evidence also pays: 33% of firms that could produce the audit evidence reported significant error reduction, against 6% of the small group that could not.
If speed is the risk, the first control question is basic: Which system holds the truth?
The ledger stays in charge
Parambath led Oracle applications teams in Asia-Pacific before joining BlackLine in 2023. So I asked him which system is authoritative when BlackLine sits across several enterprise resource planning (ERP) systems.
“You’re not going to get me into that box,” he said, before answering directly. “Your general ledger in the ERP is your ultimate system of record. That is a given.”
BlackLine’s role is to govern what happens between systems. Every accrual or expense claim reaches the general ledger eventually, but many start elsewhere: a point-of-sale terminal, a core banking platform or a spreadsheet. “If I don’t have governance and controls, then anybody can manipulate that data,” he says. “The ERP will not know that because the transaction happens somewhere else.”
His revealing insight explains why finance is hard ground for AI. “AI by definition is probabilistic. Finance by definition is a deterministic function,” he says. “2 + 2 has to be 4.”
So I gave him a CDO’s stress test. A subsidiary posts a late adjustment after its reconciliation is prepared. (A reconciliation is the check that an account balance matches its supporting records.) What happens next?
His answer starts with accounting, not code. The question comes from a “technology standpoint,” he says, but “it’s got to do with accounting rules.” GAAP and local standards set what can change after sign-off. Many companies add stricter internal policies. BlackLine encodes both, so the system is “checking whether this is allowed or not allowed” before the entry moves through “multiple levels of approvals.”
Policy comes first, automation second. For CDOs, the accounting policy becomes the specification, and the data work follows from it. Two checks belong on every vendor scorecard. Does a late entry flag or reopen a reconciliation that was already signed off? Does the audit trail record which version of the policy applied at the time?
Policy sets the rules. The next question is who, or what, may act on them.
A badge, not a master key
SoD is where finance CDOs worry most. An agentic system can start helper agents, called sub-agents, in milliseconds. A maker-checker control, where one party prepares and another approves, may not cover those new actors.
Parambath was direct. “Is my agent allowed to spin a sub-agent? No.” BlackLine’s agents are purpose-built, “like a Formula 1 car,” he says, and “the agent is deployed as a user.” If a person in that role can access only one company and one task, “the agent automatically inherits the same thing.”
That matches current security guidance. OWASP’s prompt injection prevention guidance tells builders to “enforce the caller’s permissions in execution code outside the model” and to “require action-specific approval for high-risk operations.” Access roles and posting limits sit outside the AI model, where the model cannot talk its way past them.
The design also puts weight on clean roles, and the customer owns those. ERP roles often collect conflicting rights over time, such as the right to create a supplier and also pay it. Auditors call these toxic combinations. An agent given that role inherits the conflict and can act on it at machine speed. Before you copy a role for an agent, run the SoD conflict review.
Parambath also asks whether many finance tasks need AI at all. Most follow fixed rules, he says. “Do I need AI for that? Most likely no.” Often the better fit is “pure good old automation,” which is “cheaper, faster” and “doesn’t hallucinate.” He saves AI for pattern-finding, such as scanning thousands of journal entries for signs of fraud. For a CDO sorting an AI backlog, that is a useful filter.
Inside the walls, and beyond them
Roles work inside one system. CISOs worry about the edges, and they ask a sharper question: What stops an agent from treating an invoice as an instruction? Picture a supplier PDF with hidden text that tells the system to change bank details. That is a prompt injection attack with a payment at stake. The fraud is costly even without AI: Business email compromise losses reported to the FBI reached about USD3 billion in 2025.
Parambath drew a clear line. BlackLine’s agents for matching and reconciliation are “contained within the BlackLine world only,” he says. For agents that work across systems, “there’s no universal answer to this.” It depends on “how tightly you test this thing out” before release. Customers, he says, typically bring in risk, compliance, internal audit and IT security to review a new application before go-live.
“It’s not just saying why I did something. It’s about what else did I refer to when I did something.” — Nikhil Parambath @ BlackLine
BlackLine is building for that cross-system problem. In June, it unveiled a Finance Control Console to oversee “BlackLine-native, partner, customer-developed, and third-party AI agents.” It is now in a preview program with enterprise customers and partners.
Regulators are moving the same way. On Oct. 7, the Monetary Authority of Singapore (MAS) issued AI risk management guidelines for financial institutions. They call for an inventory of AI use, an assessment of how material each use is and controls to match. Firms stay accountable for AI they buy from third parties. MAS also pointed to agentic systems that can act on their own and use tools as a reason to review controls regularly. The guidelines take effect Oct. 7, 2027.
A glass box needs a paper trail
Every control so far ends in the same place: evidence an auditor can check. Parambath names the weak spot in explainable AI himself. “AI can spin any story at the end of the day,” he says.
BlackLine’s answer is to link each AI output to its supporting documents. “It’s not just saying why I did something,” he says. “It’s about what else did I refer to when I did something.” An auditor can follow the flow from the first data pull to the journal entry sent back to the ERP. SOX controls and IT general controls (ITGCs), the baseline checks on system access and changes, are built in. BlackLine also holds ISO/IEC 42001 certification for its AI management system.
For CDOs, the difference matters. ISO 42001 certifies how a vendor manages AI. Transaction evidence proves each posting: the source data snapshot, the policy version, the approval and the final ledger balance. Auditors already test company-generated reports this way, as information produced by the entity (IPE). COSO’s guidance on internal control over generative AI sets minimum control expectations for AI uses, including posting entries. Ask your vendor two questions. Can we export the evidence? Can our external auditor repeat the result without the vendor in the room?
Evidence satisfies the auditor. It does not decide who wins when data quality and deadlines collide.
The fight hasn’t started
My last question: The CDO flags stale data, but the controller wants to close the books. Who wins?
Parambath has not seen much of that conflict, “because we have not gone to that point as yet.” In Asia, “the close always happens,” he says. “Somebody is burning the midnight oil for a few weeks.” Many of his customer conversations are about the next step: moving from automation to agents, with guardrails in place.
The market data tells the same story. Gartner’s 2026 Finance Technology Bullseye calls finance spending on AI agents “strategic bets on autonomous finance,” despite “moderate current value and early adoption.” BlackLine’s reconciliation agent, Verity Prepare, became generally available only in July. The company reports that “early adopters” cut reconciliation creation time by more than 90%. CDOs will want to test that against their own baseline. In BlackLine’s second-quarter results, CEO Owen Ryan said “deal timing was noisy this quarter as customers work through more rigorous, AI-driven evaluations.” Buyers are testing before they trust.
When the conflict comes, Parambath expects the CFO to win. “Regulators like to have a single neck to choke,” he says. No regulator, he notes, has said it will accept financial statements produced fully by AI. A human still signs.
That leaves the CDO with the work that makes the signature safe: traceable data, clean roles and a complete evidence trail. The mistake Parambath sees most often among prospects is simple. They “underestimate the complexity of training and maintenance once you have built an AI agent.”
Building the agent is the easy part. Keeping it on a short leash is the job.
Image credit: iStockphoto/Kaja Hiis
Source: www.cdotrends.com
