Leadership1 publisher3 min readPublished
A payments CEO confines the invoice agent to proposing and gives the money math to code
Michael Shmulevich says agentic finance pilots sit in risk review for two quarters because nobody defined where the reasoning stops, and his own six-layer answer leaves five layers to deterministic engineering.
The Board Room · Leadership desk
What happened
- Michael Shmulevich, who runs payment infrastructure firm Superscript Systems, writes in Forbes that AI projects in financial operations tend to sit for two quarters in risk, compliance and customer vendor assessment rather than fail outright.
- His diagnosis is that the model is almost never the cause, and that nobody designed the boundary between the part of the system that reasons and the part that moves money.
- The rule he proposes is that the agent produces a structured proposal and nothing else, with six responsibilities held in separate layers around it.
- He argues that approval thresholds keyed only to dollar amount are weak, and that novelty, bank details modified in the last 30 days, evidence quality and irreversibility predict trouble better.
- In one case from his own work, an agent misread a European decimal comma and proposed an amount about a hundred times too large, which a plausibility check caught before it reached a payment provider.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- constraint The layers that make such an agent deployable are payments and ledger work, so the scarce resource is backend ownership of policy code, validation and execution state rather than model tuning.
- cost Two quarters of stall is roughly six months of paid team time and a deferred enterprise rollout, spent on a question that no amount of model improvement answers.
- decision The live choice is sequencing: specify where the reasoning stops before the pilot, or reverse-engineer it under a reviewer's questions after the demo has already landed.
- exposure Policy written into a system prompt arrives on the same channel as the untrusted documents the agent reads, which leaves a buyer's assessor with no control to inspect that is independent of the input.
The distinction that carries this argument is tolerance for error, not capability. A language model is probabilistic by design, which is the reason to use one on the invoice that arrived as a photograph or the contract clause a lawyer wrote in 2019, and running it twice on the same input can return two slightly different answers [6]. Payment infrastructure inverts the requirement: the same input has to produce the same output every time, and splits either sum to the cent or the batch does not go out [7]. Two components with opposite tolerances, joined directly, give you something impressive that cannot go to production [18].
Count the layers in Shmulevich's answer and the resourcing question changes shape. He separates six responsibilities: the agent interprets and recommends, a policy layer decides what is permitted, deterministic code does the money math and the validation, approval thresholds decide when a human steps in, an execution layer absorbs provider timeouts and mid-batch restarts, and an append-only audit trail records what happened [9]. Take away the one layer that is the model and five remain [1], and none of the five is a prompting exercise: idempotency keys derived from the business event so that a retry produces one payment rather than two, and payment state held as a state machine rather than a boolean [12]. Wiring a language model to a payment API is a day of work, by his account; the other five layers are the project [5].
A payment-infrastructure CEO has concluded that the hard part is payment infrastructure, and the record here is a single Forbes Tech Council column with no measured stall rate behind its central claim [1][2]. What survives that limitation is the example that cuts against the tidiest reading of his own rule. A deterministic check found an invoice total that differed from the internal time tracker by more than the rounding amount, stopped it, and had no way to say why, so the reconciliation agent was sent to read the actual invoice [16]. Deterministic code is good at refusing and poor at explaining, so the line being drawn allocates authority over money movement; it does not fence the model away from the ledger.
The piece of this that does not wait is the record. Shmulevich sets the audit bar at reconstruction rather than logging: a year later, someone with no context should be able to rebuild what the agent saw, what it proposed, which model and policy versions were live, who approved it and what they were shown [13]. None of that can be backfilled once the decisions have been made. A team that ships the pilot now and answers the risk questions afterwards will be assembling its evidence out of decisions recorded without versions attached, which amounts to reconstructing the pilot after the fact instead of reviewing it as it happened.
What to watch
- Any measured stall rate for agentic finance pilots, beyond one practitioner's account of his own client work.
- Whether enterprise vendor assessments begin requiring reconstruction-grade records, with model and policy versions, instead of a human-approval attestation.
- Whether approval routing in shipped products moves off dollar thresholds and onto change signals such as bank details edited within the last 30 days.