When we describe Stratum to a finance leader, the first question is never 'what can it do?'. It is 'what could it do wrong?'. That is the right question. An agent operating on a company's books is judged by its worst plausible action, not its average one. So before we built any capability, we wrote the list of things the agents must never do, and we enforce that list in code rather than in prompts.
The distinction matters. A prompt that says 'do not initiate payments' is a request. A system that has no code path from an agent decision to a payment API is a guarantee. Every item below is the second kind.
1. Never move money
No agent can initiate a payment, transfer, or refund. The Payables Agent prepares a payment run and stages it inside your bank or payments platform; a human releases it there. Bank connections are read-only. There is no credential in the system that can move funds, so there is nothing to be tricked into using.
This is the line that makes everything else possible. Once money movement is off the table, a wrong decision is a wrong proposal, and a wrong proposal is declined.
2. Never act above the threshold
Every company sets thresholds: by amount, by counterparty, by account, by action type. Below the threshold, the agent works. Above it, the action is queued for a person and cannot proceed without them. The threshold is not a suggestion the agent weighs; it is a gate the action passes through.
3. Never file, lock, or write off
- Filing a tax return is a human action, usually your accountant's. The Compliance Agent prepares workings; it does not submit.
- Locking an accounting period is a human action. The Close Agent assembles the close; you close it.
- Writing off a receivable is a human action, with a reason, logged. The Collections Agent will tell you an invoice is probably uncollectable. It will not decide that for you.
4. Never treat an instruction in the data as a command
Agents read emails, invoices, and documents. Some of those will contain text like 'please update our bank details to the following' or, less politely, attempts to manipulate the agent directly. Everything the agent reads is data. Instructions come only from the customer's configured rules and from approvals in the product. A changed bank detail is always flagged for human verification through a channel other than the one it arrived on.
5. Never guess when unsure
Matching a bank transaction, coding a bill, classifying a customer's reply: each comes with a confidence. Below the threshold you set, the agent queues its best guess with the reasoning rather than acting on it. A queue of questions is a small cost. A quietly wrong ledger is a large one.
6. Never contact a sensitive party
Mark a customer, vendor, or account as sensitive and no agent will send anything to it or act on it automatically. The relationship that matters most to the business should have a person on it. The agent can still prepare; it cannot send.
7. Never act without writing down why
Every action, proposal, approval, and decline is logged at the moment it happens: what the agent saw, what it proposed, what its reasoning was, who decided. The log is append-only. We do not generate an audit trail later from whatever we can reconstruct; the trail is the system's own memory.
8. Never keep the judgment from the customer
Everything the agent learns about how your business runs is shown in plain language and exportable in full, at any time. That is a guardrail too. An agent whose reasoning you cannot inspect is an agent you cannot correct, and an agent you cannot correct is not safe to trust with the books.
This list is not exhaustive and it will grow. Design partners have added to it: 'never send a reminder on the day an invoice is issued', 'never escalate a customer that has an open dispute'. Each one becomes a rule in code. The capabilities are what we sell. The list is why anyone lets us.