AI Accounting That Can't Cook the Books.... numbors.com

Joe Wee · 2026-04-08

AI is already in every accounting platform

Xero launched JAX, a generative AI assistant that creates invoices, reconciles transactions, and analyses cash flow - 73% of customers have used AI features since March [1]. Intuit's AI assistant handles categorisation, reconciliation, and tax optimisation for QuickBooks [2]. Sage Copilot provides anomaly detection and predictive cash flow analysis [3]. The AICPA's 2025 report found agentic platforms are now "completing workflows end-to-end - bookkeeping agents categorise transactions, flag anomalies, generate reports, and draft client messages" [4].

But the FINOS AI Governance Framework warns: "Financial numbers are precise enough to sound authoritative - a hallucinated P/E of 31.4 is more dangerous than a hallucinated claim because the precision signals confidence." Their verdict: "LLMs are not good at maths; they were never built for precise calculation" [5]. Fortune asks the right question: "What do you do when your AI agent hallucinates with your money?" [6]

The payment execution boundary

The IMF's April 2026 paper on agentic AI in payments identifies the fundamental tension: payment infrastructure requires "predictability, auditability, and legal enforceability" while agentic AI uses "probabilistic reasoning that can yield different outcomes under similar conditions." Their proposed solution: a three-layer framework where AI operates in an "intent and orchestration" layer while strict rule-based controls remain in authorization and settlement layers [7].

This separation matters because the risks are real. Online payment fraud losses hit $48 billion globally in 2023 [8]. Stripe's 2025 report found 30% of business leaders say AI is making fake account creation and merchant fraud worse [9]. The Flipcause collapse - a Stripe Connect platform that filed Chapter 11 owing $29 million to 3,276 nonprofits after executives paid themselves $3.83 million - shows what happens when platform payment controls fail [10].

And in November 2024, the Freysa AI heist demonstrated the prompt injection risk directly: an AI agent programmed to never transfer cryptocurrency was defeated after 481 attempts when a user redefined the transfer function via prompt injection, extracting 13.19 ETH (~$47,000) [11].

The product

Numbors is a multi-tenant SaaS accounting platform - 80 MongoDB models, 56 installable modules (CRM, Payroll, Inventory, POS, Projects), and payment processing through Stripe Connect. Companies connect their own Stripe accounts via the Account Links API, and their customers pay invoices through a hosted portal. Numbors takes a 0.01% platform fee on each transaction.

The AI layer is a 12-step conductor pipeline built on Tyga Orchestrator that analyses financial data - P&L, Balance Sheet, Cash Flow, Tax Summary, Aged Receivables - using a multi-provider LLM fallback chain (self-hosted primary, OpenAI and Anthropic as fallbacks). Results are compressed using Tyga Encoder (~70% token reduction) and persisted in AgenticMemory per-company spaces.

What the AI can do

The conductor pipeline follows a strict 12-step workflow: validate, cache check, health check, extract data, build context, generate, verify, cross-analysis, enrich, persist, cache store, track usage. Every step is auditable.

What the AI cannot do

This is the critical design decision. The AI engine is read-only. It follows the IMF's three-layer model [7]: AI reasons about financial data but never touches the payment execution path:

Payment execution is entirely human-controlled. A customer visits the portal, enters card details into Stripe Elements, and confirms the payment. SOX Section 302 requires executives to personally certify the completeness and accuracy of financial statements - when AI generates or influences those statements, the certification obligation does not change [12].

The Big Four are ahead on this

EY launched an agentic platform with NVIDIA AI featuring 150 specialised tax and finance agents [13]. KPMG's Workbench was the first to achieve BSI/ISO 42001 certification for AI Management Systems, with every agent carrying a "Trusted AI stamp" assessed against their 10-pillar Trusted AI Framework [14]. The FINOS AI Governance Framework (developed by BMO, Citi, Morgan Stanley, RBC, Bank of America, with Microsoft, Google Cloud, and AWS) catalogues 46+ risks and mitigations including a dedicated agentic AI risk catalogue [5].

Where A2A Infrastructure fits

Numbors made the right architectural choice: AI reads, humans execute. But there are still surfaces that benefit from the safety shield:

Pipeline: protect the AI analysis inputs

The conductor pipeline sends financial data to an LLM. An attacker who controls a transaction description (a vendor name or invoice memo) could embed prompt injection that manipulates the analysis output. The Grafana AI assistant exfiltration demonstrated this pattern: instructions embedded in data were captured and the AI silently exfiltrated financial metrics to an attacker-controlled server [15]. OpenAI acknowledges that "given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention" [16].

The /v1/evaluate endpoint screens the assembled prompt before it reaches the LLM, applying A2A TrustGate's layered screening - deterministic denylist first, then a stateless LLM judge with zero conversation context.

Workspace: scope the development agents

Numbors has a separate expert registry for development - agents for bug triage, e2e test diagnosis, infrastructure config, and accounting domain advice. The infra agent has autonomy level "approve" - meaning it can propose infrastructure changes that need human confirmation. Scoped permissions ensure the e2e-test agent can't escalate to infrastructure modifications.

Channel: audit the memory data flow

Each company's AI insights are stored in AgenticMemory via a per-company space. Financial analysis flowing between the conductor pipeline and the memory service should be authenticated - HMAC-signed messages ensure cached insights haven't been tampered with between write and read.

The Stripe Connect architecture

For context, here's how payments flow - entirely separate from the AI layer:

Company connects Stripe account
  -> stripe.accounts.create({ type: 'standard' })
  -> Account Links onboarding (hosted by Stripe)
  -> StripeConnect record saved (chargesEnabled, payoutsEnabled)

Customer pays invoice via portal
  -> Stripe Elements card form
  -> createPaymentIntent() with 0.01% application_fee_amount
  -> stripe.confirmCardPayment(clientSecret)
  -> OnlinePayment record created
  -> Invoice status updated (paid/partial)

The platform fee is hardcoded: Math.max(1, Math.round(amountInCents * 0.0001)). Not AI-determined. Not configurable per tenant. A GBP 500 invoice generates a 5p fee. Simple, transparent, auditable.

References

  1. Xero (2026). "JAX: AI financial superagent." 73% customer adoption. Xero
  2. Intuit (2023). "Intuit Assist for QuickBooks." Intuit
  3. Accountancy Age (2025). "Top 10 AI Accounting Tools." Sage Copilot, Sage Intacct. Accountancy Age
  4. AICPA / CPA.com (2025). "2025 AI in Accounting Report." CPA.com
  5. FINOS AI Governance Framework v2.0. Hallucination risk RI-4 + agentic AI risk catalogue. FINOS
  6. Fortune (2026). "What do you do when your AI agent hallucinates with your money?" Fortune
  7. IMF Note 2026/004 (2026). "How Agentic AI Will Reshape Payments." Three-layer framework. IMF
  8. HUMAN Security (2024). Online payment fraud: $48B globally in 2023. HUMAN Security
  9. Stripe (2025). "2025 State of AI and Fraud Report." 30% say AI makes fraud worse. Stripe
  10. Bloomberg (2025). "Flipcause bankruptcy: $29M owed to 3,276 nonprofits." Bloomberg
  11. The Block (2024). "Freysa AI heist: 13.19 ETH extracted via prompt injection." The Block
  12. IBM (2025). "SOX Compliance: Section 302 executive certification." IBM
  13. EY (2025). "EY.ai Agentic Platform with NVIDIA AI: 150 agents, 80,000 professionals." EY
  14. KPMG (2025). "KPMG Workbench: first BSI/ISO 42001 AI Management certification." KPMG
  15. TechRepublic (2025). "Grafana AI assistant exfiltration via indirect prompt injection." TechRepublic
  16. OpenAI (2025). "Understanding prompt injections: a frontier security challenge." OpenAI
  17. Baysal, H. (2026). "Asimov Safety Architecture." IETF Internet-Draft
Help

Help

Need help? Here are some quick links: