Segregation of Duties for AI Agents in Finance

Segregation of duties for AI agents is the control that keeps any one person, or any agent on its own, from holding a sensitive task end to end: configuring an agent, connecting it to systems, running it, authorizing what it writes and reviewing the record. Insulin keeps what an organization agent can reach in org admins’ hands and makes some writes wait for a person, but it has no general maker-checker gate, so jobs, the spending limit and most tool calls need controls of your own.

Updated 2026-10-23: Insulin now has a third access level, Full, which is the default instead of Edit, and the email row now covers Inbox only, since an agent with a Gmail or Outlook connection can send. The matrix below is corrected.

---

An auditor looking at AI in finance asks what every system of record eventually gets asked: who can build, change, trigger and authorize what? For people, the ERP’s roles answer it. For an AI agent, the answer is spread out: who configured it, which systems it reaches and on whose credential, who runs it, and who approved what it wrote.

This post puts Insulin’s answer in one control matrix, traced to Fours’ documentation. It describes what the product does, not whether that satisfies a given audit. Each duty carries one of three statuses:

• Enforced separation: Insulin keeps the duty from the person, or the agent, that would otherwise hold it, and no setting merges them.
• Configurable separation: the duty stays apart only if roles or steps are assigned that way.
• No separation: one person, or the agent alone, can hold the whole duty.

What is segregation of duties for AI agents?

Segregation of duties for AI agents is splitting the work around an agent so that no single person controls its power from start to finish. It’s the control finance already runs for people, applied to agents.

The difference is the credential: a person in your ERP acts with their own login, while an agent acts with whatever credential its connection carries, for whoever is using it. So the familiar split between authorizing, recording and reviewing gains two duties that come first: deciding what the agent can reach, and who can use it. Insulin’s strongest controls sit on the first.

Which duties does Insulin separate, and which does it leave to you?

Insulin enforces the split around what an organization agent can reach, and it keeps the agent from completing a CRM write in Inbox or a tax correction without a person. Who uses or edits an agent is yours to configure, and unattended jobs, the spending limit and most tool calls have no separation at all.

Duty	Who can do it in Insulin	Separation	Record it leaves	What you add
Create an organization agent	Org admins only; a personal agent can’t be shared	Enforced	The owner’s name on the settings banner	Keep org admins few and named
Give an organization agent a system to act in	Org admins only: they connect the organization’s systems and are the only ones offered Fours’ own MCP server, with its tools for your Fours records; an Editor on the agent changes its integrations only if also an org admin	Enforced	The agent lists its integrations and when each was connected; no change history is documented	Review integrations and credential permissions on every agent that writes
Decide whether a custom agent can write through each integration	Whoever can change its integrations, so an org admin on an organization agent. Read-only removes an integration’s write tools, and any tool not recognized as a read; Edit keeps creating and changing records but removes deletes; Full, the default, keeps every tool. Fours’ own MCP server has no such setting: on an organization agent it is fixed at Edit	Configurable	The setting beside each integration in the agent’s Integrations list; no change history is documented	Set Read-only wherever an agent only reads, and Edit wherever it must never delete; integrations selected before the setting existed stay on Full
Change an agent’s instructions, model or knowledge bases	Its Owner, Admins and Editors; an org-wide share can make everyone an Editor	Configurable	No change history is documented	Grant Editor by name, never org-wide
Use an agent, and through it the organization’s connections	USER or above, granted by its Owner or Admins; an org-wide share reaches everyone	Configurable	The conversation, with each tool call’s inputs and outputs	Share agents that write by name only
Hand an agent to a new owner	Its owner only, to a current org admin, and only while still one	Enforced	The new owner on the banner; the old one drops to USER	Transfer before the owner’s role changes
Run an agent unattended, as a job	Any member, under an agent they name, with its access; private to them, org admins included	None	Each run’s Steps, every tool call with its Args and Result, seen only by the creator	Have creators declare jobs that write to finance systems
Authorize a CRM write from Inbox	The mailbox owner, whose own rule raised it; nothing runs until they click Run in chat	Enforced for the agent; the click is the rule author’s own	A receipt (Authorized by, when) and an outcome with before-and-after values where readable; CSV export; kept two years	Export Approvals ▸ History each review period
Send an AI-drafted email from Inbox	The mailbox owner, via Send and a confirmation, or an auto-send rule they wrote	Configurable, by each member	Who pressed Send, and when	Say in policy whether auto-send is allowed
Submit a tax correction to Avalara	A member with the org Admin or Editor role; the Tax assistant can fill in the form, never submit it	Enforced	Action history: each correction, its status and its submitter, exportable by every member	Export it each review period
Sign off an amended return	Optional: another member the creator names; an Admin or Editor can submit without one	Configurable	Who signed off, when, and the note	Require sign-off in policy
Approve a tool call before it runs	Most tool calls don’t pause. Posting to Slack does, and so does anything not recognized as a read when Insulin is @mentioned in a Slack channel, where the card can be shown; the person who asked answers	None	The card, in that conversation: Approved, Rejected or Expired in the web workspace; in Slack, who allowed or denied it	Keep write access off agents that don’t need it
Write to a knowledge base through a custom agent or the Insulin assistant	In Edit mode, only while the person it works for holds Editor or above there, re-checked before every write; it never deletes	Enforced	Retired files are deprecated, not deleted, and can be restored	Grant Editor only to the people who maintain it
Set the monthly spending limit and automatic top-up	Any member: Settings → Billing isn’t restricted to administrators	None	No change record is documented	Name who may change them; record both monthly

With no documented change history for an agent’s settings, a periodic review compares today’s settings with the ones you last wrote down. Who can run what in an AI workspace explains the roles behind each row.

Does Insulin have a maker-checker approval for agent actions?

No. Insulin has no general maker-checker gate: no setting holds an agent’s action until a second person approves it. Every approval its documentation describes is answered by the person who asked for the work, which makes it a deliberate, recorded step, not a second pair of eyes. The one documented second-person step is optional and covers one record: the creator of an amended return in the Tax app can send it to another member for sign-off, but an Admin or Editor can also submit it without one.

A reviewer will see two kinds of approval:

	Inbox CRM action	Tool approval card
What it covers	One instruction a CRM-triggered rule raised	Today, posting a message to Slack and, when Insulin is @mentioned in a Slack channel, anything it can’t recognize as a read
Where it waits	Approvals ▸ Pending	The chat that asked: a web-workspace solo chat, on its main thread, or Slack, in a DM with Insulin or a channel where it was @mentioned; not an Insulin channel, a Microsoft Teams DM, a web-workspace sub-thread or a job run
Who answers	The mailbox owner whose rule raised it	The person who asked
If nobody answers	Nothing runs	It expires after about three minutes, and the call doesn’t run
What one answer allows	One run, limited to the CRM connection the action came from	That one call
What it leaves	A receipt, an outcome and, where readable, before-and-after values in Approvals ▸ History, kept two years	A badge on the card; in Slack, who allowed or denied it

The CRM action is the stronger control, and it still isn’t segregation. The agent can’t write to the CRM without the click, the run reaches nothing else, and History keeps the authorization apart from the result. But one person wrote the rule, clicked Run in chat and holds the record; what an Inbox CRM action changed, and who authorized it reads that record field by field. The approval card is a guardrail on the surfaces that can show it, and it leaves a mark in the conversation, not a ledger; where the approval gate is armed maps those surfaces. Plan approvals work the same way: the person in the chat approves, rejects or modifies the agent’s plan.

In Tax, the AI never submits. The assistant can fill in a correction form but cannot submit it, and before Fours writes to Avalara, the running correction re-checks that the submitter still holds the Admin or Editor role. Action history’s Approver column records “who submitted it”: read it as the submitter, not a second reviewer.

Where does one person hold the whole duty?

In three places: unattended jobs, the spending limit, and every tool call that doesn’t pause. No setting splits them, so each needs a control of your own.

Jobs. A job runs an agent on demand, on a schedule or when an event arrives, within its creator’s scope and “with that agent’s access to resources and integrations.” Any member can create one, and it’s private: “only its owner can see it, run it, edit it, or delete it. That includes organization administrators.” Work Planner schedules in an organization channel is the exception, seen by every member of that channel. The approval card isn’t offered in a job run either. So one person sets up the job, triggers it and holds its only record in Insulin: each run’s Steps, every tool call with its Args and its Result or Error. Only they can show it to you.

The spending limit. Settings → Billing is not restricted to administrators, “and there is no admin-only view within it,” so the monthly spending limit and automatic top-up are any member’s to change. Settings Fours holds, like the billing model and debt limit, sit behind an approval trail on Fours’ side, recorded with who changed them, when and why. The docs describe no such record for your limit.

Tool calls that don’t pause. Apart from posting to Slack, and anything not recognized as a read when Insulin is @mentioned in a Slack channel, an agent’s tool calls run without a card. The control is what the agent can reach: its integrations and whether each one is Read-only, Edit or Full, both of which only an org admin can change on an organization agent, and the permissions of the credential behind each one. Write access an agent doesn’t have is the one control no surface can skip.

What should you hand an auditor?

Six items, each gathered by someone who can see it, because Insulin keeps much of its evidence with the person who acted.

1. The org admins. They create organization agents and decide what those agents reach.
2. Each finance agent’s integrations, Editors and sharing. Ask the agent to list its own integrations, and note whether it’s shared org-wide.
3. Approvals ▸ History for the period, exported from each mailbox that runs CRM actions. If a file ends with a truncation marker, narrow the dates.
4. Tax Action history for the period. Every member can export it.
5. Every job that writes to a finance system, opened by its creator, with recent runs’ Steps.
6. The current spending limit and top-up settings, written down, since no change record is documented.

Frequently asked questions

Does Insulin enforce segregation of duties for AI agents?

Partly. Only org admins can create an organization agent or change the systems it reaches, and Inbox CRM writes and Tax corrections wait for a person. Who uses or edits an agent is configurable, and unattended jobs, the spending limit and most tool calls have no separation.

Does Insulin have maker-checker approval for agent actions?

No general one. Every approval Insulin documents is answered by the person who asked for the work. The one second-person step is optional: an amended return in the Tax app can be sent to another member for sign-off before it’s submitted.

Can a member give an organization agent access to another system?

No. Only an org admin can connect the organization’s systems or change an organization agent’s integrations, even when someone else holds Editor on the agent. An Editor can still change its instructions, default model and knowledge bases.

Can an org admin see every member’s AI jobs?

No. A job is private to the person who created it, and that includes organization administrators. The exception is work Planner schedules in an organization channel, which every member of that channel sees.

Who can change the monthly spending limit in Insulin?

Any member. Settings → Billing is not restricted to administrators and has no admin-only view, so the spending limit and automatic top-up aren’t an admin duty unless your own policy makes them one.

Is approving an Inbox CRM action the same as a tool approval?

No. A CRM action waits in Approvals ▸ Pending until the mailbox owner clicks Run in chat, and History keeps its receipt and outcome for two years. A tool approval card holds one call, such as a Slack post, and leaves only a mark in the conversation.

Takeaways

• Org admins control what an organization agent can reach. Editors change what it’s told, and people shared as USER only use it.
• There’s no general maker-checker gate. Approvals are answered by the person who asked for the work: deliberate steps, not second reviews.
• The Inbox CRM receipt and Tax Action history are your strongest evidence. Export both every review period.
• Jobs, the spending limit and unpaused tool calls need your own controls: declared jobs, a named owner for the limit, and no write access an agent doesn’t need.

For the other controls a finance rollout needs, from grounding every number in a source to starting with one reconciliation, see AI agents for finance operations.