For most of the past few years, an AI assistant could tell you what was happening in your business but it couldn’t do much about it. That line is now moving fast. On October 21, 2026, Stripe announced Treasury for agents, which lets startups connect agents such as ChatGPT and Claude to their business account so they can check balances, pay invoices, transfer funds between accounts, and convert currencies. Other banking and payment providers are heading in the same direction, and the founders who benefit most will be the ones who write their AI agent payment approval rules before they connect anything to real money.
This isn’t a reason to stay away from the technology. Letting an agent handle the repetitive side of finance is one of the clearest wins available to a lean team. The point is that money is the one area of your business where a confident mistake is expensive and often permanent, so the rules need to exist before the access does. What follows is a practical playbook you can apply whether you use Stripe, another provider, or a custom setup.
Why Agents Touching Money Changes the Rules
When an agent drafts an email badly, you rewrite it. When an agent sends a payment to the wrong account, you may never see that money again. That difference is why the companies building these tools are designing approval into the product itself. Stripe’s own announcement describes a founder whose agent checks balances, subscriptions, failed payments, and refunds every morning and sends him a report, with his plan being to let the agent prepare contractor payments that he approves before any money moves. Stripe also states that businesses choose which accounts and data agents can access, whether agents can read information or take action, and when money movement requires human approval.
The security community has a name for what goes wrong when those choices are made carelessly. The OWASP Gen AI Security Project lists Excessive Agency as a top risk for AI systems and traces it back to three root causes: excessive functionality, excessive permissions, and excessive autonomy. In plain terms, the agent can do more than it needs to, it has wider access than it needs, and it can act on high-impact decisions without anyone checking. Every rule in this playbook is designed to close one of those three gaps.
IBM Technology’s short explainer on human oversight is worth watching before you set anything up, because it frames people as the control plane that defines goals, constraints, and allowed actions while the agent handles execution.
Start Read-Only and Earn Your Way to Action
The safest first connection is one that can’t move a cent. Give the agent read access to balances, transactions, invoices, and subscription data, then let it run for a few weeks producing the reports you would otherwise build yourself. A daily cash position, a list of failed payments, a summary of upcoming bills, and a flag on anything unusual are all valuable on their own, and none of them carries the risk of an outbound transfer.
This stage also tells you whether the agent understands your business well enough to be trusted with more. If it misreads a refund as revenue or can’t tell your operating account from your tax reserve, you want to discover that while it’s only writing summaries. Treat read-only as a probation period. The agent earns write access by being consistently accurate, and you can see that accuracy in the reports it has already produced.
Stripe’s documentation reflects this layered approach. Its Treasury tools for agents are tied to specific permissions, so a balance summary needs read access to balances and financial accounts, while sending money requires write access to outbound payments. That separation is the pattern to look for in any provider. If a tool only offers all-or-nothing access, that is a reason to wait.
Set Permission Scopes Like You Would for a New Hire
You wouldn’t hand a new bookkeeper the keys to every account on their first day, and an agent deserves the same caution. If you’re still working out which jobs belong with software and which belong with people, it helps to first decide what to automate with AI agents and then scope access to match that job and nothing more.
Break permissions down by account, by action, and by environment. An agent that pays contractors from one operating account has no reason to see your savings or your payroll account. An agent that reconciles invoices may need to read payments but never create recipients. Stripe’s documentation notes that when you connect through OAuth you can grant access to one or more live accounts or sandboxes and set different permissions for each environment, which means you can let an agent experiment freely in a sandbox while keeping it tightly restricted in live mode.
Pay attention to how the agent authenticates, too. Stripe recommends OAuth for interactive tools because you can authorize and revoke a client without sharing an API key, and for autonomous tools it recommends creating an agent API key with only the permissions that client needs. Stripe has also said that from December its MCP server will stop accepting full-access secret keys and restricted keys without the Agent tag, with a migration deadline of November 30, 2026. Whatever platform you use, the principle carries over: never give an agent a master key when a narrowly scoped one exists, and know exactly where to revoke access in a hurry.
Make Human Approval the Default for Every Dollar That Moves
The heart of any AI agent payment approval system is a simple rule: the agent can prepare a payment, but a human releases it. Stripe builds this in by default. Its Treasury for agents documentation states that you need to review and approve any action your agent takes that results in live money movement, and its MCP documentation explains that certain write actions, such as refunds and outbound payments, require human confirmation through a link where you review the details of the request. If an approval isn’t given within 24 hours, it expires.
Keep that default switched on, even when it feels slow. The value of an approval step comes from the fact that it is boring and consistent. Once you start making exceptions for small amounts or familiar names, you’ve created exactly the kind of gap that fraud and errors slip through. Stripe has said businesses will be able to set spending limits for their agents in the coming weeks, and limits are a useful extra layer, but a limit is not the same as an approval. A capped mistake is still a mistake.
When you do approve, actually review. Check the recipient name, the account details, the amount, and the reason against the original invoice or agreement. An approval screen you tap through without reading is a rubber stamp, and a rubber stamp gives you the feeling of control without any of the protection.
Build an Exception Queue Instead of Letting the Agent Guess
Agents are at their most dangerous when they meet something unexpected and try to resolve it on their own. The fix is to define, in writing, the situations where the agent must stop and hand the decision back to you. That list becomes your exception queue, a single place where flagged items wait for human judgment rather than being quietly worked around.
Good triggers for the queue include a first payment to any new recipient, any change to an existing recipient’s bank details, an amount that differs from the invoice or from previous payments to the same supplier, a possible duplicate payment, a payment that would take an account below a balance you’ve set as a floor, and any request that arrives with unusual urgency. The agent’s job when it hits one of these is to stop, explain what it found, and attach the evidence. Your job is to make the call.
Write these rules into the agent’s standing instructions and, wherever possible, into the platform’s own settings as well. Instructions inside a prompt can be ignored or manipulated, while a permission the provider enforces can’t be talked around. OWASP makes the same point, recommending that authorization be enforced in downstream systems rather than relying on the AI to decide whether an action is allowed.
Treat Changed Bank Details as a Red Alert
The most common way small businesses lose money to fraud doesn’t involve AI at all. Payment redirection scams, sometimes called business email compromise, work by impersonating a supplier you already deal with and sending an invoice with new payment details. Australia’s Scamwatch warns that a vendor or supplier’s payment details changing without notice is a key warning sign, and advises contacting the business by phone using a number you’ve sourced independently.
An agent reading your inbox and preparing payments makes this risk more urgent, not less. If a convincing fake invoice lands in your email, an agent may process it faster and with more confidence than a tired human would. The same attackers are also getting better at impersonation, which is why it’s worth understanding how deepfake CEO scams work and building verification habits that don’t depend on recognizing a voice or a face.
The rule here is absolute. An agent should never be able to add a new payee or change an existing payee’s banking details and then pay that payee in the same flow. Recipient changes go to the exception queue, you verify them through a separate channel you trust, and only then can payments resume. Stripe’s MCP documentation also advises users to turn on their client’s tool-approval setting and to be cautious when combining its server with other servers to avoid prompt injection attacks, which is a reminder that the content an agent reads can be weaponized against it.
Decide What You Will Never Automate
Some decisions should stay with you no matter how capable the tools become. Draw that line early and write it down so it doesn’t erode one convenient exception at a time.
For most founders, the never-automate list should include adding or editing payment recipients, moving money out of reserve or tax accounts, paying anyone on the strength of an email request alone, changing the agent’s own permissions or limits, and any payment that would materially change your runway. You may also want to keep payroll, loan repayments, and investor-related transfers firmly in human hands. None of these are tasks an agent can’t technically perform. They are decisions where the cost of being wrong is high enough that a few minutes of your attention is cheap insurance.
Log Everything and Review the Rules Monthly
Approval rules only work if you can see what the agent actually did. Make sure every action, whether it was approved, rejected, or flagged, leaves a record you can review. Stripe points users to tool call logs in its Workbench, and most serious platforms offer something similar. Set aside time each month to read through those logs alongside your bank statements, looking for patterns such as repeated near-misses, recipients you don’t recognize, or approvals you gave too quickly.
Review your active sessions and keys at the same time. Stripe lets users revoke individual OAuth sessions from their settings and lets administrators revoke team members’ sessions, and any provider you trust with money should offer an equally fast way to cut access. If an agent you no longer use still has a live connection to your accounts, close it.
If you want a broader framework for this kind of oversight, the NIST AI Risk Management Framework is a voluntary guide built to help organizations manage the risks of AI systems, and it’s a useful reference as your use of agents grows beyond a single account.
Speed Is the Reward for Getting Control Right
The promise of agents in finance is real. A founder who no longer spends hours reconciling accounts, chasing failed payments, and preparing transfers gets that time back for building the business. But that promise only pays off if a single bad payment can’t wipe out the gains.
Start with read-only access, scope permissions tightly, keep human approval on every dollar that moves, route anything unusual to an exception queue, protect your payee details like they’re the vault door, and keep a short list of decisions that will always be yours. Do that, and you get the speed of an AI-run back office with the judgment of a founder who still knows exactly where every dollar is going.