An agent your auditor can follow, step by step.
Human in the loop means a named person reviews and approves an AI agent's work before it takes effect. For finance and ERP agents it's what makes them auditable: COSO's February 2026 guidance expects human oversight of AI outputs that touch journal entries and reconciliations, and logs of the model, prompts, inputs, outputs and approvals behind each one.
| Human in the loop | Human on the loop | |
|---|---|---|
| How it works | A person approves each action before it takes effect | The agent acts; a person monitors and can stop it |
| Fits | Postings, payments, credits, customer emails, master data | Reading, sorting, drafting, low-risk routine replies |
| Evidence | An approval record per item | Monitoring, sampling and an off switch |
| Regulation | Matches COSO's oversight for financial reporting | EU AI Act Article 14 still requires a person able to override or stop |
Drawn from COSO, ISACA and Microsoft Purview's audit records for agents.
Useful, but read the fine print before relying on them for finance.
| Tool | What it gives you | The catch |
|---|---|---|
| Business Central agent review | Reviewer name and date recorded; changed fields marked with the agent, reason and confidence | A review step, not an approval workflow |
| Business Central vendor creation | Agent-created vendors are blocked until a person approves | Microsoft notes this is often needed to pass an audit |
| Copilot Studio AI approvals | AI-assisted decisions in flows | Microsoft says they weren't designed for decisions that affect finances |
| Copilot Studio multistage approvals | AI and human stages in one flow | Preview; the same approver can't sit on two stages |
| Microsoft Purview audit | Agent ID, version, resources accessed, injection flags | Turn it on and set retention |
From Microsoft Learn, October 2026.
Read-only, scoped by role.
Start at zero; raise only with evidence.
Payment runs stay with people.
The top fraud route; agents flag, never change.
Change control on prompts, as COSO expects.
Who started the action, the agent and its version, the prompt version, the inputs it read, the tools it called, what it proposed and rejected, the approver and time, and the final result.
For each posting: the remittance and bank line it used, the match it proposed with alternatives, the approver and time, and the ERP posting reference. Agree the evidence with your auditors early, as COSO's 2026 guidance suggests.
Yes, with controls: a named approver for anything that affects the books, change control on prompts and models, logged evidence and periodic testing. Treat the agent as part of the control, not a replacement for it.
Keep an inventory of agents, give each its own identity and owner, set an approval matrix, log everything, review monthly and know how to switch any agent off. COSO's six steps (govern, inventory, assess, design, implement, monitor) are a good frame.
Least-privilege access, thresholds that start at zero, people-only rules for payments and bank details, untrusted inputs treated as data, and every action authorised by the ERP itself, not the AI.
What identity the agent uses, which records it can reach, what it logs and for how long, how approvals work, and how you stop it.
Facts on this page checked on 22 October 2026.
Founder and CEO
Chief Sales Officer
Join our live webinar on Sept 24 and see five
ways to automate meetings, approvals, and
document search with tools already in your
tenant.
