Don’t Give AI the Company Credit Card
AI needs delegated financial authority, too.
Thus far, businesses have treated AI like a very clever intern: ask it to draft an email, summarise a report or analyse a spreadsheet. It might occasionally get something wrong, but fundamentally it waited for instructions.
That is changing. AI agents don’t just answer questions. They can increasingly carry out tasks: update records, contact customers, order products, schedule meetings and trigger business processes. AI is moving from giving advice to taking action.
Imagine hiring an employee who works 24 hours a day, operates at computer speed and can potentially access your email, accounting system, customer database and company credit card. You wouldn’t give that employee every password and say, “Use your judgment.” So why do it with AI?
The next AI investment may be governance
This week Anthropic and Accenture announced a five-year commitment totalling at least US$2 billion to independently evaluate advanced AI systems. It’s a useful signal of where the industry is heading: as AI becomes more capable, the challenge isn’t simply building better models, but controlling what they’re allowed to do.
Large corporations will have security teams, auditors and risk committees. SMEs need something simpler.
Four permissions, not one
Think about AI authority in four levels:
Permission to know → permission to recommend → permission to act → permission to spend.
They should not automatically be the same permission.
An AI might analyse every invoice you’ve received for three years without being allowed to pay one. It might identify 200 customers who haven’t purchased for six months without being authorised to email them. It might find a cheaper supplier without being allowed to cancel your existing contract.
The important boundary comes when AI moves from recommending something to doing it.
Give AI delegated authority
Suppose your AI recommends ordering another 20 units of your bestselling product. Should it place the order?
Maybe. A $50 order might be fine. A $5,000 order might need approval. A $50,000 order certainly should.
This isn’t really a new management problem. Businesses have dealt with it for years through delegated financial authority. A junior employee might approve $100, a manager $5,000 and anything larger requires a director.
AI should work the same way.
Give an agent a daily spending limit. Require approval above a transaction threshold. Restrict it to approved suppliers. Prevent it from adding bank accounts, signing contracts or making other consequential commitments without human approval.
The technology is new. The management principle isn’t.
Remember the old maxim
There’s an old management maxim: the power of a decision is inversely proportional to the amount of money it takes to change it.
Whatever version of the saying you prefer, the principle is useful for AI. Decisions that are cheap and easy to reverse can be delegated more freely. Decisions that are expensive, consequential or difficult to unwind deserve more scrutiny.
Let AI draft the email; think twice before letting it send 10,000 of them. Let it recommend a supplier; don’t let it sign the contract. Let it flag an invoice for payment; don’t necessarily let it transfer the money.
The more expensive a mistake is to undo, the more human approval AI should need.
Ask one question
Whenever someone proposes connecting AI to another business system, ask:
What’s the worst thing it could do with that access?
Not what it is supposed to do, but what it could do.
Reading your calendar is one level of risk. Sending email as the managing director is another. Issuing refunds, placing orders or transferring money is another again.
That doesn’t mean businesses should avoid AI agents. Their ability to perform routine work could make them far more valuable than today’s chatbots. But autonomy and authority are different things. An agent can have enormous freedom to analyse and recommend while having tightly controlled authority to execute.
A one-page AI policy
An SME doesn’t need a 70-page AI governance manual. Start with four questions:
- What can it know?
- What can it recommend?
- What can it do without asking?
- How much can it spend without approval?
The AI industry is spending billions figuring out how to evaluate and control increasingly capable systems. Small businesses don’t need billions. They need boundaries.
Your new AI employee may never sleep, never take holidays and may eventually do a week’s administrative work before you’ve finished breakfast.
Just don’t give it the company credit card without a limit.