Inspiration

As AI agents become capable of taking real actions, we started asking a simple question: what happens when an AI agent is allowed to touch money?

In accounting, a mistake is more than a bad answer. An agent could pay the same bill twice, act on incomplete context, send money to an unexpected destination, or confidently take an action that does not match the business owner's intent.

We wanted to make financial agents useful without giving them unchecked authority.

That led us to build LedgerGuard, a safety layer for AI financial agents in QuickBooks.

What it does

LedgerGuard reviews a financial action before an AI agent is allowed to execute it.

System One looks at the surrounding accounting context and identifies risks that are difficult to capture with simple rules, such as:

whether the action actually matches the user's goal
whether a payment may be a duplicate
whether a vendor or destination change looks suspicious
whether important information is missing
whether the action looks unusual compared with the company's history

But the model never has the final say.

Its output is passed to a deterministic policy engine, which decides whether the action should be:

allowed
sent for human approval
blocked
or paused until more context is provided

Every decision includes a reason code, the threshold that triggered it, and an audit record.

In short: System One helps us understand risk. Code decides what the agent is actually allowed to do.

How we built it

We built LedgerGuard around a strict separation between judgment and authority.

The backend uses FastAPI and a shared accounting-state representation built from the QuickBooks hackathon dataset. Every risk provider receives the same context and returns structured risk signals with confidence scores.

We then pass those signals into a deterministic policy engine. LangGraph coordinates the workflow, including human-review paths, while the policy layer remains the only component that can authorize an action.

We also built a React dashboard that makes the process visible: users can see the proposed action, the detected risks, the final decision, and why that decision was made.

All financial execution in our prototype is simulated so we can safely test the complete decision flow.

Challenges we faced

One of the hardest parts was deciding where AI should stop.

It would have been easy to let the model return "safe" or "unsafe" and execute based on that answer. But in a financial system, model confidence should not be the same thing as authority.

We therefore designed LedgerGuard so that model failures, malformed responses, timeouts, or low-confidence judgments can never silently become an approval.

Another challenge was building useful context without leaking information that would make the evaluation unrealistic. We had to normalize accounting records, derive relevant financial features, and give every model the same compact view of the business.

We also learned that human review is only useful when humans are shown a small number of decisions that actually require judgment. Sending everything to a person simply moves the bottleneck instead of solving it.

What we learned

We learned that safe AI agents are not just a model problem. They are a systems-design problem.

A strong model can provide useful judgment, but reliable software still needs clear authority boundaries, deterministic safeguards, confidence handling, auditability, and graceful failure behavior.

We also learned that uncertainty can be useful when it is represented explicitly. Instead of forcing every situation into "safe" or "unsafe," confidence scores let the system escalate ambiguous cases to a person.

Finally, being transparent about limitations and tradeoffs made our evaluation much more meaningful than trying to present the model as perfect.

What's next for LedgerGuard

We want LedgerGuard to become a general control layer for autonomous financial agents.

Next, we would like to:

pass a business owner's instructions directly into the risk check, so requests like "pay today's bills but hold Acme" become enforceable constraints
let owners answer missing-context questions through messaging and automatically re-evaluate the action
route high-risk decisions to an Intuit Expert when the owner wants a second opinion
extend the same safety layer beyond bill payments to journal entries, transfers, and other financial actions

Our long-term goal is simple: make financial AI agents more autonomous without making financial decisions less accountable.