Satya Nadella’s recent X post makes a sound case for separating intelligence from authority, validating independently, and preserving evidence of what happened. In financial operations, the practical question is what those controls check against.
An agent issues a refund. The action is logged. The approval process was followed. A data system may be able to reconstruct every step.
But did the refund meet the terms of the merchant agreement or partnership agreement?
Independent controls and audit trails help establish whether a system followed its instructions. In financial operations, those instructions also need to reflect the business’s obligations. A refund can follow an internal approval process and still violate the merchant agreement. The controls need to check both.
In financial operations, much of that standard is already written down. Those requirements come from the institution’s own policies and procedures, its regulators, the networks it participates in, and its agreements with other parties. Together they say what may happen, what must happen, when it must happen, and what is owed.
The challenge is connecting those requirements to the activity they govern.
A processor invoice can pass every internal approval and still bill a pricing tier above the one in the fee schedule. An account can be live and transacting for a week before the screening the onboarding policy requires has run. A reserve requirement can change in an addendum while the control checking it continues to use the old terms.
These problems existed before AI. Institutions have long relied on people, periodic reviews and samples to find them. Agents increase the speed and volume of activity those controls have to cover. Periodic reviews and sampling may not keep pace.
That makes the governance discussion relevant well beyond the teams deploying AI. The same question applies to work performed by employees, vendors and existing software: did what happened match what was required?
For a board overseeing an operation that moves money, three questions make the governance discussion concrete:
- Can you reconstruct what happened end to end?
- Can you map what your systems did to the policies you wrote?
- Can you produce the evidence when somebody asks?
Then pick one transaction and put those answers to the test: what was it supposed to do, and how do we know it did that?
The answer should connect the action to the requirement that governed it, whether that requirement is the institution’s own policy or a contract it signed. It should show what was required, what happened, and whether the two matched.
If producing that answer still depends on someone finding a document and manually checking the transaction, that is the work ahead.
At Cordant, we focus on that connection. Cordant Controls checks financial activity against the institution’s own policies and applicable regulatory requirements. Cordant Counterparties checks it against the contracts and agreements signed with processors, partners, merchants and customers. In both cases the work is the same: read the documents that define what should happen, and check what actually happened against them, with the evidence attached.
Whether a person or an agent moves the money, the institution needs evidence that what happened matched what was required.
