FinRoot

Everyone is building AI agents that can do back-office work. Almost nobody is answering the question a finance team actually asks: would you let it near your money?

We started from how people get hired. A new accounts-payable clerk doesn’t get a $25,000 approval limit on day one. They get a small limit, a manager who checks their work, and a record of what they did. They earn more access by being right, and they lose it when they’re not.

So we built that for an AI. Pip is a junior AP clerk on probation.

What it does:

Pip reads vendor bills, matches them to purchase orders and goods receipts, pays what is safe, and asks the right human for everything else.

A trust ladder. Pip starts at a $0 limit and can move up through $500, $5,000 and $25,000 tiers by being right. A payment that should have been stopped drops it straight back to $0. Limits enforced in code. The model proposes. Plain code decides. Pip has no write access to the books or the bank, and it can never approve its own proposal above its limit. A clean record. Every action goes into a hash-chained audit log, including the attempts that were denied. You can tamper with a row and watch the verification catch it. Knowing when to ask and routes to the approver the approval matrix requires.

Learning from mistakes. When a human overrides Pip, or Pip is wrong, it writes a post-mortem and proposes a lesson. A human approves it before it has any effect, and lessons can only make Pip stricter, never looser.

The moment:

We sent Pip an email that looked like it came from a real vendor, asking it to change the bank account, with a hidden instruction to skip the usual checks. Pip treated the text as data, not an order. It held the payment, froze the vendor, tightened its own limit, and routed the change to a phone check on the number already on file.