Answer in brief: Five tasks were suitable for bounded automation, eight required review, and five were prohibited. The dividing line was consequence and reversibility, not how fluent the output sounded.
Which parts of an agentic money or business workflow can be delegated without delegating accountability? A useful answer has to be narrower than a product claim. This article tests a bounded workflow, publishes the scoring surface, and keeps consequential approval with a person. It does not turn a controlled result into personalized financial advice.
What we tested or analyzed
We mapped 18 representative tasks to three dispositions using consequence, reversibility, data sensitivity, and independent-verification criteria derived from NIST risk guidance.
The original asset is a eighteen-task capability and risk matrix. The complete machine-readable table is available as CSV. The evidence visual below summarizes the primary criterion; its values are also written in text and shown in the table, so the chart is not the only way to obtain the result.
The measured result
Five tasks were suitable for bounded automation, eight required review, and five were prohibited. The dividing line was consequence and reversibility, not how fluent the output sounded.
The row-level outcome distribution was automate: 5, prohibit: 5, review: 8. Those labels are deliberately more descriptive than one blended score. A partial, review, stale, exception, or unsupported row can carry a different operational risk from a plainly wrong row, so the CSV preserves the reason beside the disposition.
| Item | Outcome | Evidence or note |
|---|---|---|
| Task 01 | automate | format a synthetic dataset |
| Task 02 | automate | detect missing fields |
| Task 03 | automate | create a first-pass summary |
| Task 04 | automate | route a low-risk draft |
| Task 05 | automate | recompute deterministic totals |
| Task 06 | review | categorize ambiguous expenses |
| Task 07 | review | draft a customer reply |
| Task 08 | review | flag unusual transactions |
| Task 09 | review | compare disclosed loan terms |
| Task 10 | review | extract annual-report claims |
| Task 11 | review | forecast from explicit assumptions |
| Task 12 | review | suggest reconciliation matches |
| Task 13 | review | summarize interview themes |
| Task 14 | prohibit | move money |
| Task 15 | prohibit | approve credit |
| Task 16 | prohibit | file taxes |
| Task 17 | prohibit | publish without review |
| Task 18 | prohibit | use secrets in a consumer chatbot |
Reading the evidence row by row
- Task 01 was recorded as automate. The evidence note is “format a synthetic dataset”; the disposition remains visible so it cannot be averaged away.
- Task 02 was recorded as automate. The evidence note is “detect missing fields”; the disposition remains visible so it cannot be averaged away.
- Task 03 was recorded as automate. The evidence note is “create a first-pass summary”; the disposition remains visible so it cannot be averaged away.
- Task 04 was recorded as automate. The evidence note is “route a low-risk draft”; the disposition remains visible so it cannot be averaged away.
- Task 05 was recorded as automate. The evidence note is “recompute deterministic totals”; the disposition remains visible so it cannot be averaged away.
- Task 06 was recorded as review. The evidence note is “categorize ambiguous expenses”; the disposition remains visible so it cannot be averaged away.
- Task 07 was recorded as review. The evidence note is “draft a customer reply”; the disposition remains visible so it cannot be averaged away.
- Task 08 was recorded as review. The evidence note is “flag unusual transactions”; the disposition remains visible so it cannot be averaged away.
- Task 09 was recorded as review. The evidence note is “compare disclosed loan terms”; the disposition remains visible so it cannot be averaged away.
- Task 10 was recorded as review. The evidence note is “extract annual-report claims”; the disposition remains visible so it cannot be averaged away.
- Task 11 was recorded as review. The evidence note is “forecast from explicit assumptions”; the disposition remains visible so it cannot be averaged away.
- Task 12 was recorded as review. The evidence note is “suggest reconciliation matches”; the disposition remains visible so it cannot be averaged away.
- Task 13 was recorded as review. The evidence note is “summarize interview themes”; the disposition remains visible so it cannot be averaged away.
- Task 14 was recorded as prohibit. The evidence note is “move money”; the disposition remains visible so it cannot be averaged away.
- Task 15 was recorded as prohibit. The evidence note is “approve credit”; the disposition remains visible so it cannot be averaged away.
- Task 16 was recorded as prohibit. The evidence note is “file taxes”; the disposition remains visible so it cannot be averaged away.
- Task 17 was recorded as prohibit. The evidence note is “publish without review”; the disposition remains visible so it cannot be averaged away.
- Task 18 was recorded as prohibit. The evidence note is “use secrets in a consumer chatbot”; the disposition remains visible so it cannot be averaged away.
The expected label or control was fixed before review. The visible note explains why the row received its disposition. The chart uses the published primary criterion, but the table is authoritative because it preserves exceptions that a single percentage would hide.
How to reproduce the check
- Download the CSV and read its labels, units, and synthetic/public-data notice before using it.
- Write the expected answers or decision rule before looking at a model response.
- Use the same bounded prompt and record the model or tool, access surface, and date.
- Preserve the raw response. Break prose into atomic claims rather than grading the tone of the whole answer.
- Recompute arithmetic with deterministic formulas and verify definitions against the linked primary sources.
- Record correct, partial, wrong, uncertain, and refused outcomes separately. Do not silently repair the model output before scoring it.
- Repeat material checks after a model, source, or workflow changes.
What the result means
The value of this result is diagnostic. It shows where a structured assistant can reduce search, formatting, or first-pass review work. It does not transfer responsibility for the underlying decision. A “pass” means the row met the published rule in this test, on this date, with these inputs.
The errors and open items matter more than a polished average. In money and business workflows, one missed assumption, stale fact, false match, or overconfident definition can dominate many correct low-risk rows. That is why the artifact keeps row-level outcomes and why a human reviews exceptions rather than receiving only a percentage.
Reproducibility also has limits. A reader can repeat the steps and inspect the same answer key, but a probabilistic model may not return identical wording. A useful rerun should therefore compare atomic claims, calculations, citations, and escalation decisions—not superficial phrasing.
Why this topic needs its own boundary
Tool documentation describes available components, not a validated business process. Release notes can establish that a model or tool exists, while only a controlled test can show whether the surrounding prompt, permissions, data, and approval path work for a defined task.
A useful evaluation therefore treats the model as one changing component. The answer key, source hierarchy, access controls, audit trail, and rollback route belong to the workflow and should remain understandable even when the model name changes.
A safer operating workflow
- Give agents least-privilege tools.
- Separate preparation from approval.
- Log inputs, tool calls, outputs, and overrides.
- Require deterministic checks for calculations.
- Stop on missing data, ambiguous identity, or irreversible action.
How each control changes the decision
Control 1: Give agents least-privilege tools. For this test, that control answers the bounded question “Which parts of an agentic money or business workflow can be delegated without delegating accountability?” without extending the result into an untested decision.
Control 2: Separate preparation from approval. For this test, that control answers the bounded question “Which parts of an agentic money or business workflow can be delegated without delegating accountability?” without extending the result into an untested decision.
Control 3: Log inputs, tool calls, outputs, and overrides. For this test, that control answers the bounded question “Which parts of an agentic money or business workflow can be delegated without delegating accountability?” without extending the result into an untested decision.
Control 4: Require deterministic checks for calculations. For this test, that control answers the bounded question “Which parts of an agentic money or business workflow can be delegated without delegating accountability?” without extending the result into an untested decision.
Control 5: Stop on missing data, ambiguous identity, or irreversible action. For this test, that control answers the bounded question “Which parts of an agentic money or business workflow can be delegated without delegating accountability?” without extending the result into an untested decision.
Keep data collection, model preparation, deterministic validation, and approval as separate stages. Use the least sensitive input that can answer the question. If removing personal or confidential data makes the result ambiguous, route the case to an approved human process instead of restoring secrets to an unapproved tool.
Calculations need an independent formula; current facts need a current primary source; classifications need an “uncertain” route; and irreversible actions need explicit authorization outside the model. Logs should capture the version, prompt, source date, output, reviewer, correction, and final disposition without retaining unnecessary personal data.
Limitations and professional boundary
The matrix is a small-business governance aid, not a legal classification. A regulated institution needs jurisdiction-specific controls and validation.
This publication provides general educational information. It does not know a reader’s finances, duties, jurisdiction, contracts, tax treatment, credit position, or risk tolerance. A qualified financial, accounting, tax, legal, lending, security, or other professional should review decisions with material consequences.
Primary sources
- OpenAI API tools guide
- NIST AI Risk Management Framework
- NIST Generative AI Profile
- Federal Reserve revised model risk guidance SR 26-2
Verified 2026-07-26. Primary-source links can change; use the publication date and linked source to check for a newer version.
Bottom line
Five tasks were suitable for bounded automation, eight required review, and five were prohibited. The dividing line was consequence and reversibility, not how fluent the output sounded. The practical lesson is to make AI produce inspectable work inside a controlled process—not to make fluency the final control.