--- title: "Segregation of Duties for AI Agents in Finance" url: https://www.insulin.dev/blog/segregation-of-duties-ai-agents/ canonical: https://www.insulin.dev/blog/segregation-of-duties-ai-agents/ type: Blog description: "Segregation of duties for AI agents in Insulin: which duties are enforced, which are configurable, which have none, and the record each one leaves." --- # Segregation of Duties for AI Agents in Finance > Canonical HTML version: https://www.insulin.dev/blog/segregation-of-duties-ai-agents/ 1. [Home](/) 2. [Blog](/blog/) 3. Segregation of Duties for AI Agents in Finance # Segregation of Duties for AI Agents in Finance Insulin keeps what an organization agent can reach in admins' hands, but it has no general maker-checker gate. A duty-by-duty matrix for controllers and auditors: what's enforced, what's configurable, and where one person holds the whole duty. ![Sophia Faria](/authors/sophia-faria.jpg) Sophia Faria Oct 14, 2026 ![Segregation of Duties for AI Agents in Finance](/images/blog/segregation-of-duties-ai-agents/hero.png) Explore AI Summary [![](/logos/company/openai.svg)](https://chat.openai.com/?q=Read%20and%20summarize%20https%3A%2F%2Fwww.insulin.dev%2Fblog%2Fsegregation-of-duties-ai-agents%2F%2C%20then%20cite%20the%20source.%20Focus%20on%20what%20it%20says%20about%20Trust%2C%20Security. "Summarize with ChatGPT")[![](/logos/company/anthropic.svg) ](https://claude.ai/new?q=Read%20and%20summarize%20https%3A%2F%2Fwww.insulin.dev%2Fblog%2Fsegregation-of-duties-ai-agents%2F%2C%20then%20cite%20the%20source.%20Focus%20on%20what%20it%20says%20about%20Trust%2C%20Security. "Summarize with Claude")[![](/logos/company/gemini.svg)](https://www.google.com/search?udm=50&aep=11&q=Read%20and%20summarize%20https%3A%2F%2Fwww.insulin.dev%2Fblog%2Fsegregation-of-duties-ai-agents%2F%2C%20then%20cite%20the%20source.%20Focus%20on%20what%20it%20says%20about%20Trust%2C%20Security. "Summarize with Gemini")[](https://www.perplexity.ai/search/new?q=Read%20and%20summarize%20https%3A%2F%2Fwww.insulin.dev%2Fblog%2Fsegregation-of-duties-ai-agents%2F%2C%20then%20cite%20the%20source.%20Focus%20on%20what%20it%20says%20about%20Trust%2C%20Security. "Summarize with Perplexity") Table of Contents - [What is segregation of duties for AI agents?](#what-is-segregation-of-duties-for-ai-agents) - [Which duties does Insulin separate, and which does it leave to you?](#which-duties-does-insulin-separate-and-which-does-it-leave-to-you) - [Does Insulin have a maker-checker approval for agent actions?](#does-insulin-have-a-maker-checker-approval-for-agent-actions) - [Where does one person hold the whole duty?](#where-does-one-person-hold-the-whole-duty) - [What should you hand an auditor?](#what-should-you-hand-an-auditor) - [Frequently asked questions](#frequently-asked-questions) - [Takeaways](#takeaways) _Segregation of duties for AI agents is the control that keeps any one person, or any agent on its own, from holding a sensitive task end to end: configuring an agent, connecting it to systems, running it, authorizing what it writes and reviewing the record. Insulin keeps what an organization agent can reach in org admins’ hands and makes some writes wait for a person, but it has no general maker-checker gate, so jobs, the spending limit and most tool calls need controls of your own._ _Updated 2026-10-23: Insulin now has a third access level, Full, which is the default instead of Edit, and the email row now covers Inbox only, since an agent with a Gmail or Outlook connection can send. The matrix below is corrected._ * * * An auditor looking at AI in finance asks what every system of record eventually gets asked: who can build, change, trigger and authorize what? For people, the ERP’s roles answer it. For an AI agent, the answer is spread out: who configured it, which systems it reaches and on whose credential, who runs it, and who approved what it wrote. This post puts Insulin’s answer in one control matrix, traced to Fours’ documentation. It describes what the product does, not whether that satisfies a given audit. Each duty carries one of three statuses: - **Enforced separation:** Insulin keeps the duty from the person, or the agent, that would otherwise hold it, and no setting merges them. - **Configurable separation:** the duty stays apart only if roles or steps are assigned that way. - **No separation:** one person, or the agent alone, can hold the whole duty. ## What is segregation of duties for AI agents? **Segregation of duties for AI agents is splitting the work around an agent so that no single person controls its power from start to finish.** It’s the control finance already runs for people, applied to agents. The difference is the credential: a person in your ERP acts with their own login, while an agent acts with whatever credential its connection carries, for whoever is using it. So the familiar split between authorizing, recording and reviewing gains two duties that come first: deciding what the agent can reach, and who can use it. Insulin’s strongest controls sit on the first. ## Which duties does Insulin separate, and which does it leave to you? **Insulin enforces the split around what an organization agent can reach, and it keeps the agent from completing a CRM write in Inbox or a tax correction without a person. Who uses or edits an agent is yours to configure, and unattended jobs, the spending limit and most tool calls have no separation at all.** Duty Who can do it in Insulin Separation Record it leaves What you add Create an organization agent [Org admins only](https://doc.fours.com/insulin/agents/#user-level-vs-org-level-agents); a personal agent can’t be shared **Enforced** The owner’s name on the settings banner Keep org admins few and named Give an organization agent a system to act in [Org admins only](https://doc.fours.com/insulin/agents/#integrations-and-knowledge-bases): they connect the organization’s systems and are the only ones offered Fours’ own MCP server, with its tools for your Fours records; an Editor on the agent changes its integrations only if also an org admin **Enforced** The agent lists its integrations and when each was connected; no change history is documented Review integrations and credential permissions on every agent that writes Decide whether a custom agent can write through each integration [Whoever can change its integrations](https://doc.fours.com/insulin/agents/#integrations-and-knowledge-bases), so an org admin on an organization agent. **Read-only** removes an integration’s write tools, and any tool not recognized as a read; **Edit** keeps creating and changing records but removes deletes; **Full**, the default, keeps every tool. Fours’ own MCP server has no such setting: on an organization agent it is fixed at **Edit** **Configurable** The setting beside each integration in the agent’s **Integrations** list; no change history is documented Set **Read-only** wherever an agent only reads, and **Edit** wherever it must never delete; integrations selected before the setting existed stay on **Full** Change an agent’s instructions, model or knowledge bases [Its Owner, Admins and Editors](https://doc.fours.com/insulin/agents/#sharing-agents); an org-wide share can make everyone an Editor **Configurable** No change history is documented Grant Editor by name, never org-wide Use an agent, and through it the organization’s connections USER or above, granted by its Owner or Admins; [an org-wide share](https://doc.fours.com/insulin/agents/#org-wide-sharing) reaches everyone **Configurable** The conversation, with each tool call’s inputs and outputs Share agents that write by name only Hand an agent to a new owner [Its owner only](https://doc.fours.com/insulin/agents/#transferring-ownership), to a current org admin, and only while still one **Enforced** The new owner on the banner; the old one drops to USER Transfer before the owner’s role changes Run an agent unattended, as a job [Any member](https://doc.fours.com/insulin/jobs/#how-jobs-are-created), under an agent they name, with its access; private to them, org admins included **None** Each run’s Steps, every tool call with its Args and Result, seen only by the creator Have creators declare jobs that write to finance systems Authorize a CRM write from Inbox [The mailbox owner](https://doc.fours.com/insulin/inbox/#running-a-crm-action), whose own rule raised it; nothing runs until they click **Run in chat** **Enforced** for the agent; the click is the rule author’s own A receipt (**Authorized by**, when) and an outcome with before-and-after values where readable; CSV export; kept two years Export **Approvals ▸ History** each review period Send an AI-drafted email from Inbox The mailbox owner, via **Send** and a confirmation, or [an auto-send rule](https://doc.fours.com/insulin/inbox/#when-an-auto-send-rule-may-send) they wrote **Configurable**, by each member Who pressed **Send**, and when Say in policy whether auto-send is allowed Submit a tax correction to Avalara [A member with the org Admin or Editor role](https://doc.fours.com/revenue/tax/corrections/#submit-a-correction); the Tax assistant can fill in the form, never submit it **Enforced** **Action history**: each correction, its status and its submitter, exportable by every member Export it each review period Sign off an amended return Optional: [another member the creator names](https://doc.fours.com/revenue/tax/amended-returns/#take-a-return-to-submitted); an Admin or Editor can submit without one **Configurable** Who signed off, when, and the note Require sign-off in policy Approve a tool call before it runs Most tool calls don’t pause. Posting to Slack does, and so does anything not recognized as a read when Insulin is @mentioned in a Slack channel, [where the card can be shown](https://doc.fours.com/insulin/agents/#tool-approvals); the person who asked answers **None** The card, in that conversation: **Approved**, **Rejected** or **Expired** in the web workspace; in Slack, who allowed or denied it Keep write access off agents that don’t need it Write to a knowledge base through a custom agent or the Insulin assistant In Edit mode, [only while the person it works for holds Editor or above](https://doc.fours.com/insulin/knowledge-base/#choosing-which-knowledge-bases-insulin-uses) there, re-checked before every write; it never deletes **Enforced** Retired files are deprecated, not deleted, and can be restored Grant Editor only to the people who maintain it Set the monthly spending limit and automatic top-up [Any member](https://doc.fours.com/insulin/billing/faq/#who-in-our-organization-can-see-the-billing-page): **Settings → Billing** isn’t restricted to administrators **None** No change record is documented Name who may change them; record both monthly With no documented change history for an agent’s settings, a periodic review compares today’s settings with the ones you last wrote down. [Who can run what in an AI workspace](/blog/role-based-access-for-ai-workspaces/) explains the roles behind each row. ## Does Insulin have a maker-checker approval for agent actions? **No. Insulin has no general maker-checker gate: no setting holds an agent’s action until a second person approves it.** Every approval its documentation describes is answered by the person who asked for the work, which makes it a deliberate, recorded step, not a second pair of eyes. The one documented second-person step is optional and covers one record: the creator of an amended return in the Tax app can [send it to another member for sign-off](https://doc.fours.com/revenue/tax/amended-returns/#take-a-return-to-submitted), but an Admin or Editor can also submit it without one. A reviewer will see two kinds of approval: Inbox CRM action Tool approval card What it covers One instruction a CRM-triggered rule raised Today, posting a message to Slack and, when Insulin is @mentioned in a Slack channel, anything it can’t recognize as a read Where it waits **Approvals ▸ Pending** The chat that asked: a web-workspace solo chat, on its main thread, or Slack, in a DM with Insulin or a channel where it was @mentioned; not an Insulin channel, a Microsoft Teams DM, a web-workspace sub-thread or a job run Who answers The mailbox owner whose rule raised it The person who asked If nobody answers Nothing runs It expires after about three minutes, and the call doesn’t run What one answer allows One run, limited to the CRM connection the action came from That one call What it leaves A receipt, an outcome and, where readable, before-and-after values in **Approvals ▸ History**, kept two years A badge on the card; in Slack, who allowed or denied it **The CRM action is the stronger control, and it still isn’t segregation.** The agent can’t write to the CRM without the click, the run reaches nothing else, and History keeps the authorization apart from the result. But one person wrote the rule, clicked **Run in chat** and holds the record; [what an Inbox CRM action changed, and who authorized it](/blog/inbox-crm-action-audit-trail/) reads that record field by field. The approval card is a guardrail on the surfaces that can show it, and it leaves a mark in the conversation, not a ledger; [where the approval gate is armed](/blog/where-the-approval-gate-is-armed/) maps those surfaces. Plan approvals work the same way: the person in the chat approves, rejects or modifies the agent’s plan. **In Tax, the AI never submits.** The assistant [can fill in a correction form but cannot submit it](https://doc.fours.com/revenue/tax/#scope-and-limits), and before Fours writes to Avalara, the running correction re-checks that the submitter still holds the Admin or Editor role. Action history’s **Approver** column records “who submitted it”: read it as the submitter, not a second reviewer. ## Where does one person hold the whole duty? **In three places: unattended jobs, the spending limit, and every tool call that doesn’t pause.** No setting splits them, so each needs a control of your own. **Jobs.** A job runs an agent on demand, on a schedule or when an event arrives, [within its creator’s scope](https://doc.fours.com/insulin/jobs/#how-jobs-are-created) and “with that agent’s access to resources and integrations.” Any member can create one, and it’s private: “only its owner can see it, run it, edit it, or delete it. That includes organization administrators.” Work Planner schedules in an organization channel is the exception, seen by every member of that channel. The approval card isn’t offered in a job run either. So one person sets up the job, triggers it and holds its only record in Insulin: each run’s **Steps**, every tool call with its Args and its Result or Error. Only they can show it to you. **The spending limit.** [Settings → Billing is not restricted to administrators](https://doc.fours.com/insulin/billing/faq/#who-in-our-organization-can-see-the-billing-page), “and there is no admin-only view within it,” so the monthly spending limit and automatic top-up are any member’s to change. Settings Fours holds, like the billing model and debt limit, [sit behind an approval trail on Fours’ side](https://doc.fours.com/insulin/billing/spend-controls/#what-you-cannot-change-here), recorded with who changed them, when and why. The docs describe no such record for your limit. **Tool calls that don’t pause.** Apart from posting to Slack, and anything not recognized as a read when Insulin is @mentioned in a Slack channel, an agent’s tool calls run without a card. The control is what the agent can reach: its integrations and whether each one is **Read-only**, **Edit** or **Full**, both of which only an org admin can change on an organization agent, and the permissions of the credential behind each one. Write access an agent doesn’t have is the one control no surface can skip. ## What should you hand an auditor? **Six items, each gathered by someone who can see it**, because Insulin keeps much of its evidence with the person who acted. 1. **The org admins.** They create organization agents and decide what those agents reach. 2. **Each finance agent’s integrations, Editors and sharing.** Ask the agent to [list its own integrations](https://doc.fours.com/insulin/agents/#asking-an-agent-about-its-own-integrations), and note whether it’s shared org-wide. 3. **Approvals ▸ History for the period**, exported from each mailbox that runs CRM actions. If a file ends with a truncation marker, narrow the dates. 4. **Tax Action history for the period.** Every member can export it. 5. **Every job that writes to a finance system**, opened by its creator, with recent runs’ Steps. 6. **The current spending limit and top-up settings**, written down, since no change record is documented. ## Frequently asked questions ### Does Insulin enforce segregation of duties for AI agents? Partly. Only org admins can create an organization agent or change the systems it reaches, and Inbox CRM writes and Tax corrections wait for a person. Who uses or edits an agent is configurable, and unattended jobs, the spending limit and most tool calls have no separation. ### Does Insulin have maker-checker approval for agent actions? No general one. Every approval Insulin documents is answered by the person who asked for the work. The one second-person step is optional: an amended return in the Tax app can be sent to another member for sign-off before it’s submitted. ### Can a member give an organization agent access to another system? No. Only an org admin can connect the organization’s systems or change an organization agent’s integrations, even when someone else holds Editor on the agent. An Editor can still change its instructions, default model and knowledge bases. ### Can an org admin see every member’s AI jobs? No. A job is private to the person who created it, and that includes organization administrators. The exception is work Planner schedules in an organization channel, which every member of that channel sees. ### Who can change the monthly spending limit in Insulin? Any member. Settings → Billing is not restricted to administrators and has no admin-only view, so the spending limit and automatic top-up aren’t an admin duty unless your own policy makes them one. ### Is approving an Inbox CRM action the same as a tool approval? No. A CRM action waits in Approvals ▸ Pending until the mailbox owner clicks Run in chat, and History keeps its receipt and outcome for two years. A tool approval card holds one call, such as a Slack post, and leaves only a mark in the conversation. ## Takeaways - **Org admins control what an organization agent can reach.** Editors change what it’s told, and people shared as USER only use it. - **There’s no general maker-checker gate.** Approvals are answered by the person who asked for the work: deliberate steps, not second reviews. - **The Inbox CRM receipt and Tax Action history are your strongest evidence.** Export both every review period. - **Jobs, the spending limit and unpaused tool calls need your own controls:** declared jobs, a named owner for the limit, and no write access an agent doesn’t need. For the other controls a finance rollout needs, from grounding every number in a source to starting with one reconciliation, see [AI agents for finance operations](/blog/ai-agents-for-finance-operations/). ## Sources Primary sources for the platform rules cited above. Last verified October 15, 2026. Providers change their products, prices and terms without notice — check the source before relying on a detail. - [Insulin Getting Started — Fours Doc](https://doc.fours.com/insulin/getting-started/) — Adoption Path: organization integrations under Settings → Integrations, viewable by any member but connected or disconnected only by an org ADMIN; Organization Roles: only an ADMIN creates organization-level resources; Your own things are not role-gated: any member, a VIEWER included, manages the jobs they create, and a job is visible and runnable only to its creator, admin or not; Resource Roles: EDITOR modifies an agent's system prompt, model and knowledge bases, USER chats without changing configuration; Working with a Shared Resource: the owner-and-role banner naming the owner; Sharing Constraints: agents shared org-wide only as EDITOR or USER - [Insulin Agents — Fours Doc](https://doc.fours.com/insulin/agents/) — User-Level vs Org-Level Agents: only org admins create org-level agents, and a personal agent's Share button is disabled; Integrations and Knowledge Bases: each integration on a custom agent set to Read-only, its write tools removed and a tool Fours does not recognise as a read treated as a write, Edit, creating and changing records but never deleting them, or Full, the default and what an integration selected before the access setting existed keeps; the Fours MCP server offered only on organization agents and only to org admins, with a fixed Edit badge instead of an access select; editing an organization agent's integrations requires org administrator access, which prevents a shared agent from being quietly granted new organization-level tool access, and a knowledge base's Edit mode creates, updates and deprecates files but never deletes; Asking an agent about its own integrations: each one's level and when it was connected; Sharing Agents: ADMIN on the agent manages shares, EDITOR edits the configuration and, for org admins, the integration allowlist; Org-Wide Sharing: EDITOR or USER, never ADMIN; Transferring Ownership: by the owner only, to an org ADMIN only, the former owner dropping to USER; Tool Calls: inputs and outputs expandable; Tool Approvals: the calls that pause, posting to Slack and, when Insulin is mentioned in a Slack channel, anything it can't recognize as a read; the card offered in an interactive web-workspace solo chat on the main thread and in Slack, in a DM with Insulin or a channel where it was @mentioned; the three-minute expiry, the Approved, Rejected and Expired badges, and no card in an Insulin channel, a Microsoft Teams DM, a web-workspace sub-thread or a job run; Approving a Slack message in Slack: only the person who asked can answer, the buttons replaced by Allowed by or Denied by - [Insulin Jobs — Fours Doc](https://doc.fours.com/insulin/jobs/) — How Jobs Are Created: a job runs within its creator's scope, under the agent named and with that agent's access to resources and integrations, and is private to its owner, organization administrators included, except work Planner schedules in an organization channel; Runs: the Output, Steps and Input tabs, Steps being the tool-call transcript with each call's Args and Result or Error - [Insulin Inbox — Fours Doc](https://doc.fours.com/insulin/inbox/) — The Inbox app never sends email on its own, an auto-send rule the member writes being the one exception, and Send needs a separate confirmation; Running a CRM action: never executed silently, nothing until Run in chat, the receipt with Authorized by and when, the outcome, and the run limited to the CRM connection the action came from; Approvals ▸ History: who pressed Send and when, before-and-after values where the record could be read, CSV Export with a truncation marker, and two-year retention for CRM-action records - [Insulin Knowledge Bases — Fours Doc](https://doc.fours.com/insulin/knowledge-base/) — Choosing which knowledge bases Insulin uses: Read or Edit with the same meaning as for a custom agent, Fours re-checking your own role on the knowledge base immediately before every write; Syncing and Indexing: a deprecated document retired from search but not deleted, and restorable; Sharing and Roles: Owner, Admin, Editor and User, User limited to search and read - [Insulin Billing FAQ — Fours Doc](https://doc.fours.com/insulin/billing/faq/) — Access: Settings → Billing not restricted to administrators, with no admin-only view within it - [Insulin Payment, Limits, and Top-Ups — Fours Doc](https://doc.fours.com/insulin/billing/spend-controls/) — The payment method, monthly spending limit and automatic top-up as the organization's own controls on Settings → Billing; the limit pausing AI requests for the rest of the month and stopping automatic top-up; the billing model, debt limit and suspension set by Fours behind an approval trail recorded with who changed them, when and why - [Revenue Tax — Fours Doc](https://doc.fours.com/revenue/tax/) — Tax as an app in Insulin; Scope and limits: a correction written to Avalara only when someone submits it, the in-app assistant able to fill in a correction form but not submit it, Admin or Editor needed to submit corrections and amended returns, and sign-off open to the member named as approver - [Revenue Tax corrections — Fours Doc](https://doc.fours.com/revenue/tax/corrections/) — Every correction written only when you submit it; the running correction re-checking, before any write, that you still hold the Admin or Editor role; Action history recording every submitted correction, its Approver column showing who submitted it, readable and exportable by every member - [Revenue Amended tax returns — Fours Doc](https://doc.fours.com/revenue/tax/amended-returns/) — Request sign-off optional, the approver any other current member of the organization, only the named approver able to sign off, the sign-off recording who, when and the note; an Admin or Editor able to submit a draft directly ## Keep reading - [TrustAI Gateway in an AI Workspace: What It ControlsOct 23, 2026](/blog/ai-gateway-ai-workspace/) - [TrustRestrict AI Models, Not Just Their ProvidersOct 14, 2026](/blog/restrict-ai-models-not-just-providers/) - [TrustOWASP LLM Top 10: Mapping an AI WorkspaceOct 12, 2026](/blog/owasp-llm-top-10-ai-workspace/) - [TrustOWASP Agentic Top 10: An AI Workspace ChecklistOct 8, 2026](/blog/owasp-agentic-top-10-checklist/) [Browse every post on the Insulin Blog](/blog/) ### Stay Updated New posts, product updates and marketplace strategy are shared on LinkedIn as they publish. [Follow Fours on LinkedIn](https://www.linkedin.com/company/suger-inc)