GA
Audit Agent
Collects, labels, and packages audit evidence on request.
~900 hours1 (modeled outcome) saved per audit year
Finance agent
GAControls Agent
The Controls Agent is a governed AI agent that tests each transaction for duplicates, anomalies, and policy breaches.
How it works
What the Controls Agent does
Continuously tests invoices, payments, expenses, vendor changes, and journal entries against your policies. Flags exceptions with evidence; AP and controllership decide.
- 01
Connect AP, procurement, and the GL
Read access to invoices, payments, POs, receipts, vendor master, expense reports, card feeds, and journal entries. Load your approval matrix and policy thresholds.
- 02
Choose and tune the tests
Enable tests from the library: duplicates, three-way match, vendor bank changes, split purchases, preparer-approver conflicts, expense policy. Set thresholds per entity.
- 03
Test continuously, flag with evidence
As transactions post, the agent tests them and raises exceptions with side-by-side evidence and a suggested owner. Nothing is blocked or reversed automatically.
- 04
Disposition and evidence
AP and controllership mark each exception true or false positive. Dispositions tune precision. The test log becomes SOX control evidence in the Registry.
app.meridian.example/agents/controls/exceptions
Exceptions · payment run 2026-09-14
6,412 invoices tested5 exceptions
| Invoice | Finding | Amount | State | Action |
|---|---|---|---|---|
| INV-2291 | Possible duplicate of INV-2274 | $12,480.00 | Held | Approve |
| INV-2288 | Vendor bank detail changed 6 days ago | $4,812.40 | Held | Approve |
| INV-2284 | Three-way match · quantity variance | $1,208.65 | Cleared | — |
| INV-2279 | Split invoice below approval threshold | $9,950.00 | Review | Approve |
| INV-2271 | Duplicate confirmed · payment stopped | $28,410.00 | Stopped | — |
The agent contract
Six terms, applied to this agent
Every Meridian agent runs under the same six terms, enforced at the Gateway below the agent. Here is what each one means for the Controls Agent.
Scoped to one workflow
Tests transactions against your control rules. It never blocks or reverses a payment.
Reads only permitted data
Reads AP, procurement, vendor master, expenses, and journals. It holds no ERP roles.
Every action logged
Complete test log retained as SOX 404 evidence: population, tests run, results, dispositions.
Consequential actions require human approval
Every exception requires a human disposition before anything changes.
Measurable outcome
Exceptions raised, precision, and duplicate value caught reported per entity.
Runs on your chosen model
Fuzzy-match tests are versioned rules. The model explains matches; it does not decide them.
Scope
Data, actions, and approvals
What the Controls Agent reads, what it does on its own, and where a person signs.
Data it reads
- AP invoices, payment runs, and payment history
- Vendor master with change history and bank details
- Purchase orders, goods receipts, and contracts
- Expense reports and corporate card feeds
- Journal entries with preparer and approver
- Employee master (for vendor-employee matching) and the approval matrix
Actions it takes
- Detect duplicate invoices with fuzzy matching across vendor, amount, date, and number
- Flag three-way match exceptions between invoice, PO, and receipt
- Flag vendor bank-detail changes without verification and vendor-employee address matches
- Detect split purchases under approval thresholds and preparer-approver conflicts
- Test expense reports against policy and card feeds against receipts
- Package each exception with evidence and log the control test for SOX
What needs approval
- Never blocks, holds, or reverses a payment on its own; it raises exceptions for AP and controllership
- Tests and thresholds are configurable per entity and versioned with approver
- Every exception requires a human disposition, which is logged and used to tune precision
- Segregation-of-duties tests read role assignments only; the agent holds no ERP roles
- Complete test log retained as SOX 404 evidence with population, tests run, and results
Outcomes
Numbers the Controls Agent is accountable for
Modeled outcomes from design-partner deployments. The Registry reports your actuals from the first week an agent is live.
$283K
per year in duplicate payments avoided at one design partner1
100%
of transactions tested, not a sample
−55%
false positives versus rules-only tools1
< 24 h
from posting to exception raised
- 1.Modeled outcome from design-partner deployments. ↩
“The auditors asked for the lineage record on the first package and never asked again. We went through interim fieldwork without pulling anyone off the close.”
3days
shorter close by the second cycle at Castellan Financial1
In production at
Integrations
Systems it works with
Connected through prebuilt connectors and zero-copy warehouse access in Data Fabric. The agent acts as the user and inherits each system’s permissions on every read.
- ERP
- AP automation
- Procurement
- Expense management
- Corporate card providers
- Banking
- Snowflake
Credits
What the Controls Agent costs
Included on every plan: Starter with 5,000 credits per month, Growth with 30,000, and Enterprise with custom pools. Credits are consumed per completed action, never per message. Usage beyond the plan is billed at $0.12 per credit.
| Action | Credits |
|---|---|
| Transactions tested, per 100 | 5 |
| Exception package with evidence | 2 |
| Control test evidence report, per control per period | 5 |
Questions
Questions about the Controls Agent
Answered the way buyers ask them. Each answer is also published as structured data.
It is testing 100% of transactions against control rules as they post, rather than sampling after the period closes. Meridian's Controls Agent runs the tests, raises exceptions with evidence, and logs every result so control testing evidence accumulates continuously.
ERP checks are exact-match on invoice number and vendor. They miss an invoice resubmitted with a suffix, a different vendor record for the same supplier, or a PDF re-keyed with a transposed digit. The agent uses fuzzy matching across vendor, amount, date, and number, plus vendor master de-duplication, and explains each match so AP can decide quickly.
No. It raises an exception before the payment run with the evidence attached. AP or the controller decides. Some customers add an approval step in their AP system triggered by an open exception; that step is theirs to configure.
Yes. Each test run is logged with the population, the rule, the results, and the human disposition. The Controls Agent produces per-control, per-period evidence reports that internal and external auditors can read directly, and the Audit Agent can package them into PBC responses.
One design partner in financial services identified about $283,000 per year in duplicates in the first 90 days. Recovery and avoided leakage typically exceed the agent's credit cost within the first quarter for companies processing more than 3,000 invoices per month. Your figure depends on volume and current control maturity.
Related agents
Agents most often deployed alongside the Controls Agent, on the same data and the same approval policy.
Get started
Put the Controls Agent to work.
Start with one workflow, one approver, and one number to move. Most design partners were live in five weeks.