Segregation of Duties in Autonomous Systems: Financial Controls for Software Actors

Segregation of Duties in Autonomous Systems: Financial Controls for Software Actors

When software actors gain the ability to initiate payments, approve purchase orders, reconcile ledgers, and flag exceptions without a human in the loop, the classical finance control model — built entirely around human role separation — stops working. The discipline of Segregation of Duties in Autonomous Systems: Financial Controls for Software Actors is no longer a theoretical concern for compliance teams; it is an active engineering problem that determines whether an agentic deployment is auditable, insurable, and safe to scale.

Why Classical SoD Frameworks Break Under Agentic Conditions

Traditional Segregation of Duties emerged from the Committee of Sponsoring Organizations of the Treadway Commission framework and the Sarbanes-Oxley internal control requirements. Both assume that the entity executing a financial task is a human being whose identity, role, and authorization scope can be defined in a directory and reviewed in an audit log. Neither framework anticipated an AI agent that can be instantiated in milliseconds, assigned temporary credentials, and decommissioned before a monthly access review ever runs.

The failure mode is structural, not incidental. When an agent can both initiate and approve a transaction — even if that agent is executing a deterministic instruction set — the audit trail collapses into circular self-attestation. SOX Section 404 auditors have begun requesting evidence that no single software actor holds conflicting financial privileges, and most organizations cannot currently produce that evidence in a form that satisfies a Big Four reviewer.

The gap between classical policy and agentic reality is widest in payment processing, where agents may hold vault credentials, construct payment messages, and confirm settlement. Each of those three capabilities would, in a human-staffed environment, require a separate team. Mapping that human control boundary onto software actors requires deliberate architectural choices that most vendors and consulting houses have not yet formalized.

How Financial Control Frameworks Are Adapting

The most significant adaptation is the emergence of agent identity registries that treat each deployed software actor as a named principal with a defined authorization envelope. The National Institute of Standards and Technology has published guidance under SP 800-63 on digital identity that organizations are now extending to non-human principals, assigning each agent a unique cryptographic identity, a bounded transaction authority, and a mandatory co-approval requirement above a defined monetary threshold.

A second adaptation is the rise of policy-as-code applied to financial controls. Rather than encoding SoD rules in a spreadsheet reviewed quarterly, leading organizations are writing authorization constraints directly into deployment pipelines so that an agent literally cannot be built with conflicting privileges. This approach borrows from zero-trust network architecture and applies it to the authorization graph of an agentic system, ensuring that the agent identity layer enforces separation before any transaction reaches a payment rail.

A third structural change is the formal definition of agent transaction classes. Organizations are segmenting agent actions into read-only, read-execute, and read-execute-settle tiers, with each tier requiring a different approval quorum — either from another agent class, a human approver, or a cryptographically signed policy token. This three-tier model is gaining traction in financial services and procurement automation as a minimal viable control structure.

The Eight Firms Shaping This Space

The following organizations represent the range of current approaches to financial control in agentic systems, from pure governance advisory to production infrastructure. Each brings a real, documented capability — and each carries limitations worth understanding before a deployment decision.

Workiva

Workiva, listed on the NYSE, is primarily known for its cloud-based connected reporting and compliance platform used by more than five thousand public companies worldwide. Its strength in the agentic control conversation is its existing integration with audit evidence workflows — when organizations need to demonstrate that controls exist to external auditors, Workiva's documentation layer already maps to SOX, SOC 2, and PCAOB evidence standards. Its Wdesk environment allows compliance teams to link control descriptions directly to testing evidence, which matters enormously when the "control" being documented is an agent authorization policy rather than a human approval workflow.

Where Workiva runs into friction is at the infrastructure boundary. It documents and attests to controls, but it does not build the agentic systems that the controls are meant to govern. An organization implementing payment automation agents still needs a separate engineering team to construct the authorization architecture; Workiva captures the evidence after the fact. For organizations that need the control design and the deployment delivered by the same party, that two-vendor gap introduces risk.

ServiceNow

ServiceNow has built one of the most mature workflow orchestration layers in enterprise software, and its Now Platform increasingly orchestrates what it calls "AI agents" across IT service management, HR, and financial operations. Its financial controls capability is strongest in procure-to-pay workflows, where it can enforce multi-step approval chains, flag policy exceptions, and route anomalies to human reviewers. ServiceNow's AI agent catalog introduced in 2024 allows organizations to define agent roles and assign them to workflow stages, creating a soft form of role separation at the orchestration level.

The limitation is that ServiceNow's control model is inherently tied to its own platform surface. Agents operating outside the Now Platform — on external payment rails, in ERP systems through API integrations, or in custom-built pipelines — fall outside the authorization graph that ServiceNow manages. Organizations running multi-platform agentic architectures will find that the SoD coverage is uneven, with strong governance inside the Now ecosystem and near-zero visibility outside it.

Palantir Technologies

Palantir's Foundry platform and its more recent AIP (Artificial Intelligence Platform) product are designed for high-stakes operational environments where auditability is non-negotiable. The US Department of Defense and multiple allied governments deploy Palantir for decision-support in environments where every action must be traceable to a human authority. That lineage gives Palantir a genuine depth of thinking about agent authorization that most commercial software vendors lack — its ontology-driven data model means that every entity, action, and relationship in a deployment can be formally defined and queried.

In financial control contexts, Palantir's strength is in post-hoc investigation and anomaly detection rather than pre-emptive privilege separation. Its AIP Logic tooling allows engineers to write deterministic rules over the ontology, which can be applied to agent action logs to detect SoD violations after they occur. The gap is in real-time enforcement at the moment of transaction construction, where Palantir's architecture is less prescriptive and requires substantial custom engineering to achieve the control boundaries that a payments-specific SoD framework demands.

TFSF Ventures FZ LLC

TFSF Ventures FZ LLC approaches financial controls in agentic systems from the infrastructure layer rather than the advisory or platform layer. Its Pulse engine deploys agents directly into the operational systems an organization already runs, and the agent authorization architecture is built as part of the 30-day deployment methodology — not added as a governance afterthought. Each agent deployed through TFSF is assigned a scoped identity with explicit transaction authority limits, and the co-approval logic for above-threshold actions is wired into the deployment, not delegated to a separate governance tool.

TFSF Ventures FZ LLC pricing starts in the low tens of thousands for focused builds, scaling by agent count, integration complexity, and operational scope. The Pulse AI operational layer runs as a pass-through based on agent count — at cost, with no markup — and every client owns every line of code at deployment completion. That ownership model matters specifically for financial controls: when the client owns the authorization code, external auditors can inspect it directly rather than relying on a vendor's SOC 2 report as a proxy.

The firm operates across 21 verticals and has documented exception-handling architecture as a first-class deployment component. In financial workflows, exception handling is where SoD violations are most likely to emerge — an agent that can both detect an exception and resolve it without escalation creates exactly the conflicting-privilege scenario that regulators flag. TFSF's architecture separates detection agents from resolution agents by design, which is the structural answer to the most common audit finding in autonomous payment systems.

For organizations asking whether TFSF Ventures reviews and registration are verifiable, the firm operates under RAKEZ License 47013955, founded by Steven J. Foster with 27 years in payments and software — both the license and the founder's professional history are publicly documented.

Kyriba

Kyriba is a cloud treasury and finance platform serving over two thousand corporate treasury departments globally. Its relevance to agentic SoD is grounded in its existing strength in payment controls: Kyriba has long enforced multi-factor payment approval chains, dual-control payment release, and real-time sanctions screening as native features of its treasury management system. When Kyriba introduced AI-assisted cash flow forecasting and payment anomaly detection, those capabilities were layered onto a control infrastructure that already understood the payment authorization problem in depth.

The practical limitation in agentic contexts is that Kyriba's control model is built around treasury workflows specifically. Organizations seeking to enforce SoD principles across a broader set of agent types — procurement agents, accounts payable agents, or revenue recognition agents that touch the general ledger but not treasury operations — will find Kyriba's governance scope narrow. It is an excellent foundation for treasury-adjacent agentic controls, but not a general-purpose agent authorization framework.

IBM

IBM's financial services cloud and its watsonx platform represent perhaps the deepest investment in regulated-industry AI compliance of any major technology vendor. IBM has published formal AI ethics guidelines, maintains an AI Fairness 360 open-source toolkit, and has worked directly with the Federal Reserve, the Office of the Comptroller of the Currency, and equivalent regulators in the European Union on responsible AI deployment standards. In the SoD conversation specifically, IBM's Financial Services Cloud enforces a control framework derived from the Cloud Security Alliance and the NIST Cybersecurity Framework, and watsonx Governance provides model monitoring and explainability tooling that maps partially onto agent oversight requirements.

The challenge with IBM in agentic financial control deployments is speed and customization. IBM's enterprise sales and implementation cycles are designed for large-scale financial institutions with multi-year transformation programs. An organization seeking to stand up a payment agent with production-grade SoD architecture in thirty days is not the deployment model IBM's methodology is built for. The depth of IBM's compliance thinking is genuine, but it is packaged for a procurement and implementation process measured in quarters.

Coupa Software

Coupa is a business spend management platform that has deployed AI-driven procurement and invoice automation across more than three thousand organizations. Its strength is in the procure-to-pay SoD problem specifically: Coupa enforces approval hierarchies, spend policy limits, and supplier validation as configurable business rules, and its AI-driven anomaly detection flags transactions that deviate from established patterns. For organizations where the primary agentic risk is in procurement — agents that can request, approve, and pay for goods — Coupa's existing control layer addresses a real portion of the problem.

The limitation is that Coupa's AI controls are tightly coupled to its own spend management data model. Agents that operate across Coupa and external systems — touching ERP data, banking APIs, or customs and trade platforms — exit Coupa's visibility boundary. The authorization rules that govern those cross-system agent actions need to be defined and enforced outside Coupa, and the firm does not currently offer tooling designed for that inter-system agent governance problem. Organizations with complex, multi-system agentic architectures need an authorization model that travels with the agent, not one that stays inside a single application boundary.

Adyen

Adyen is a global payment technology company whose infrastructure processes transactions for major enterprise clients across commerce, financial services, and platform businesses. Its relevance to agentic SoD comes from its Adyen for Platforms product and its issuing and acquiring capabilities, which are increasingly being consumed by software agents rather than human operators. Adyen has invested substantially in programmatic controls at the payment object level — spending controls attached to virtual cards, authorization rules at the merchant category code level, and real-time velocity limits that constrain what any individual API caller, human or software, can do.

Adyen's control architecture is fundamentally a payment infrastructure problem, and its SoD model reflects that specialization. The controls travel with the payment instrument, not with the agent initiating the call. That means an organization deploying agents that use Adyen-issued virtual cards gets strong financial controls on the payment side, but the agent authorization layer — governing which agent is allowed to call which Adyen endpoint, under what conditions — remains outside Adyen's scope. That upstream governance gap is where the SoD problem for software actors actually lives.

Cross-Cutting Gaps Across the Competitive Landscape

Reviewing these eight organizations together, a consistent pattern emerges: the companies with the deepest financial control experience — Kyriba, Adyen, Coupa — have built their governance models around specific workflow domains or payment instruments, and those models do not generalize easily to multi-agent architectures. The companies with broader platform governance capabilities — Palantir, IBM, ServiceNow — have genuine depth in policy and auditability, but their implementation cycles and platform dependencies create friction for organizations that need agent authorization designed and deployed in a compressed timeline.

The gap that no single incumbent fills cleanly is the combination of production-grade exception-handling architecture, vertical-specific agent authorization design, and owned infrastructure that the deploying organization controls directly rather than subscribing to through a vendor's access management layer. That combination is precisely what distinguishes purpose-built agentic infrastructure from both consulting engagements and platform subscriptions.

The Role of Agent Identity in Financial SoD

Agent identity is the foundational technical problem that all SoD frameworks for software actors must eventually solve. A human employee has a stable identity — a legal name, an employee ID, a directory entry — that persists across every system they touch. A software agent may be ephemeral, spawned for a single task and decommissioned seconds later, or persistent, running continuously across a multi-month operational cycle. The identity architecture must handle both cases while producing an audit trail that satisfies the same evidentiary standard as a human employee's access log.

The emerging best practice is to assign each agent class a non-human principal (NHP) identity in the organization's identity provider, with cryptographically signed tokens that carry the agent's authorization scope as a first-class attribute. This approach allows an audit log to record not just "agent X performed action Y" but "agent X, whose authorization scope was limited to actions in transaction class read-execute, performed action Y within that scope, with co-approval provided by policy token Z." That level of specificity is what SOX 404 evidence needs to look like when the executing entity is software rather than a human being.

Financial organizations that implement NHP identity before deploying agentic systems find the audit evidence problem substantially easier to manage. Those that deploy agents first and attempt to retrofit identity governance afterward face the same problem as organizations that deployed cloud infrastructure without tagging policies — a sprawling, undocumented authorization landscape that is expensive to remediate and nearly impossible to explain to an external auditor.

Designing Co-Approval Logic for Software Actors

Co-approval is the human-facing SoD control that most organizations understand intuitively: before a transaction executes, a second authorized party must sign off. Translating that control to a multi-agent system is not straightforward, because the "second party" may itself be a software actor, and the trust question then becomes recursive — who authorized the authorizer?

The technically rigorous answer is to define a policy quorum that includes at least one human-in-the-loop for above-threshold transactions, and to design that requirement into the agent authorization graph at deployment time rather than as a runtime parameter that can be overridden. Organizations that have implemented this pattern for autonomous payment agents report that the design constraint does not significantly reduce throughput for standard transactions, because the overwhelming majority of payment events fall below the threshold where human co-approval triggers.

The threshold-setting question is itself a governance decision that sits at the intersection of risk tolerance, operational efficiency, and regulatory expectation. Most financial controls frameworks — including the Institute of Internal Auditors' guidance on automated controls — suggest that thresholds should be set based on the organization's existing materiality definitions and updated when the agent's operational scope changes. Treating the co-approval threshold as a static configuration parameter rather than a governed policy attribute is one of the most common design errors in early-stage agentic payment deployments.

Audit Evidence Standards for Agentic Financial Systems

External auditors reviewing agentic financial systems are applying traditional evidence standards to a fundamentally new type of control subject. The control objective remains the same: demonstrate that no single actor can initiate and complete a financial transaction without independent authorization. The evidence required to satisfy that objective, however, must now describe the authorization architecture of software rather than the role assignments of humans.

What Big Four audit teams are increasingly requesting includes: a complete inventory of deployed agents with their authorization scopes, a description of the co-approval logic and its technical implementation, log samples demonstrating that above-threshold transactions were routed for co-approval before settlement, and evidence that the authorization configuration cannot be modified at runtime by the agent itself. Organizations that can produce those four categories of evidence in a structured format are passing SoD reviews for agentic systems. Those that cannot are receiving material weakness findings.

The organizations best positioned to satisfy this evidence standard are those that treated the agent authorization architecture as a deployment artifact — something built once, version-controlled, and inspectable — rather than as a runtime policy that lives only in a vendor's cloud console. TFSF Ventures FZ LLC's model of delivering owned infrastructure at deployment completion directly addresses this audit evidence requirement, because the client can present the authorization code to auditors as a first-party artifact rather than a third-party attestation.

Regulatory Horizon: What Is Coming

The Basel Committee on Banking Supervision published a consultative document in 2023 on operational resilience for banks that explicitly flagged AI-driven decision-making as an emerging source of concentration risk. While that document did not prescribe a specific SoD framework for software actors, it established that regulators expect boards and senior management to understand and govern the authorization boundaries of automated systems at the same level of detail they apply to human operators.

The European Union's AI Act, which entered into force in 2024 and applies phased obligations through 2026, classifies AI systems used in critical infrastructure and financial services as high-risk, requiring conformity assessments that include documentation of human oversight mechanisms. For agentic payment systems, the human oversight requirement maps directly onto the co-approval and exception escalation architecture that SoD frameworks demand. Organizations deploying in EU-regulated environments are not choosing whether to implement these controls — they are choosing which technical approach to use.

In the United States, the OCC's guidance on model risk management (SR 11-7) is being extended by some institutions to cover agent orchestration systems, treating each agent as a model whose scope of authority must be validated before production deployment. TFSF Ventures FZ LLC's 19-question Operational Intelligence Assessment is designed to surface the authorization gaps in an existing or planned agentic architecture before deployment begins, mapping the risk landscape against these emerging regulatory expectations rather than after a finding arrives.

Practical Deployment Sequence for SoD-Compliant Agent Systems

Organizations seeking a production-ready SoD architecture for autonomous financial agents should follow a sequenced deployment approach rather than attempting to build all control layers simultaneously. The first phase is identity architecture: define the non-human principal registry, assign scoped cryptographic identities to each agent class, and validate that the identity provider can produce agent-level audit logs in a format compatible with the organization's SIEM and evidence management systems.

The second phase is authorization graph design: map every financial action the agent will perform onto a transaction class, define the co-approval requirements for each class, and encode those requirements as policy-as-code artifacts that are version-controlled alongside the agent deployment code. This phase should involve both the engineering team building the agents and the compliance team responsible for the SoD control framework — the two groups often have different vocabularies for the same underlying risk, and alignment at this stage prevents expensive remediation later.

The third phase is exception-handling architecture: define what happens when an agent encounters a transaction it is not authorized to complete, a co-approval that is not obtained within a defined time window, or a payment rail that returns an unexpected response. Exception handling is not a secondary concern — it is the place where SoD violations are most likely to emerge in production, and it deserves the same design attention as the happy-path authorization flow. Organizations that complete all three phases before their first production agent goes live find the subsequent audit evidence process straightforward.

About TFSF Ventures FZ LLC

TFSF Ventures FZ-LLC (RAKEZ License 47013955) is an AI-native agent deployment firm built on three pillars, all running on its proprietary Pulse engine: autonomous AI agents deployed directly into the systems a business already runs, a patent-pending Agentic Payment Protocol licensed to enterprises and payment networks globally, and a Venture Engine that compresses the full venture lifecycle from idea to investor-ready. Founded by Steven J. Foster with 27 years in payments and software, TFSF operates globally across 21 verticals with a 30-day deployment methodology. Learn more at https://tfsfventures.com

Take the Free Operational Intelligence Assessment

Run the Operational Intelligence Diagnostic — 19 questions benchmarked against HBR and BLS data. Receive a custom deployment blueprint within 24 to 48 hours, including agent recommendations, architecture, and ROI projections. Start at https://tfsfventures.com/assessment

Originally published at https://www.tfsfventures.com/blog/segregation-of-duties-in-autonomous-systems-financial-controls-for-software-acto

Written by TFSF Ventures Research