The Four Autonomy Tiers for Finance Agents: Advise, Propose, Execute-with-Approval, Autonomous-within-Bounds

A vendor will tell you their finance agent can “run your close.” A CFO who has actually shipped one will tell you the agent runs about nine specific tasks inside the close, and that two of them never touch a ledger entry without a person clicking approve. The gap between those two sentences is the entire problem with how agentic AI gets sold into finance right now.

Granting an agent blanket autonomy is the most common and most expensive mistake. Gartner expects more than 40% of agentic AI projects to be scrapped before the end of 2027, and weak governance is one of the named reasons. The fix is not slower adoption. It is a tiered model where every workflow gets assigned a specific level of independence, with explicit dollar thresholds and a clear answer to one question: if the agent gets this wrong, how fast and how cheaply can we undo it?

Autonomy is a property of the workflow, not the agent

The instinct is to ask “how autonomous is your agent?” That is the wrong unit. The same agent should advise on one task, propose on another, and act freely on a third. Autonomy belongs to the workflow it is performing, scored on two axes: dollar impact and reversibility.

A misclassified expense report is a few hundred dollars and trivially reversed. A wrong wire to a vendor is six or seven figures and effectively permanent the moment it settles. Treating those two as one “autonomy setting” is how teams either bottleneck everything behind human review or, worse, let an agent push an irreversible action it should never have been near.

So before any tier assignment, you map the work. Reversible and low-dollar moves up the autonomy ladder. Irreversible and high-dollar moves down, no matter how confident the model looks in a demo.

The four tiers

Tier 1: Advise. The agent surfaces analysis, flags an anomaly, drafts a variance explanation. It takes no action. A person makes every decision. This is where most finance AI genuinely belongs today, and it is not a consolation prize. An agent that reads the full GL and tells you which three accounts moved unexpectedly this month, with the figures pulled from a reconciled source, is doing real work even if a human types the conclusion.

Tier 2: Propose. The agent assembles a specific action and drops it into an approval queue. A journal entry, a reclassification, a draft payment run. Zero execution without a click. The value over Tier 1 is that the human reviews a finished proposal instead of a recommendation they then have to build themselves.

Tier 3: Execute-with-approval. Now thresholds enter. The agent executes automatically below a CFO-defined limit and routes anything above it for sign-off. Vendor payments under, say, a set ceiling clear without intervention; anything larger waits. Many teams add a second, higher band that requires two approvers. This is the tier where agents start saving real hours, and it only works if the threshold logic is enforced by the system rather than living in the model’s judgment.

Tier 4: Autonomous-within-bounds. The agent acts inside a defined parameter set with no per-action approval. Reconciling sub-ledger entries that match within tolerance. Refreshing a forecast on new actuals. Every action is logged in real time and is reversible. The phrase that matters is within bounds: autonomy here is fenced by policy, not granted as a blank check. This is governed autonomy: humans set the rules above the system instead of approving each transaction inside it. (We dig into why per-action approval caps you at human speed in Governed Autonomy vs. Human-in-the-Loop.)

Where most tiering exercises quietly break

Teams design a clean four-tier matrix, assign workflows, write the thresholds, and feel governed. Then the agent does something inexplicable, and the rollback meeting reveals the real problem: nobody can reconstruct what the agent saw when it acted.

Tiers govern what an agent is allowed to do. They say nothing about whether the numbers underneath were correct. An agent at Tier 4 reconciling within a 0.5% tolerance is only safe if the figures it is comparing actually tie out to the ledger. If the agent is doing its own probabilistic arithmetic on raw GL fields, your tolerance band is measuring noise, and “autonomous within bounds” means autonomous within bounds you cannot trust.

This is the dependency that gets skipped. Every tier, even Advise, rests on a reconciled numbers layer. The autonomy framework controls the blast radius of an action. It does nothing about the accuracy of the figure that triggered the action. You need both, and the second one has to come first.

The accuracy floor under every tier

Rexfin sits beneath the agent as that floor. It connects your accounting and financial-data systems (QuickBooks, Xero, NetSuite, Sage, SAP, Oracle, your warehouse, or uploaded statements) and builds one reconciled model that ties out to the ledger. The agent does not compute on raw data. It retrieves figures from the reconciled model and runs calculations through a deterministic engine, not the language model. (The reasoning-versus-execution split is its own subject; see Why Finance Agents Must Call Tools, Not Compute.)

That changes what each tier actually means. A Tier 3 threshold check runs against a figure that traces to source. A Tier 4 tolerance band is measured against numbers that reconcile. When an agent acts, the value that justified the action is one you can prove later, which is exactly what an auditor will ask for, and what decision-level logging has to capture to be worth anything (covered in Audit Trails That Record Decisions, Not Just Actions).

How to actually roll this out

Start everything new at Tier 1. Promote a workflow one tier only after it has run clean against known-correct answers for a defined period, not after a good demo. Set thresholds in real money your board would recognize, and write them where the system enforces them, not where a prompt suggests them. Keep a kill switch that drops any agent back to Tier 1 the moment a metric drifts. And re-examine the assignments quarterly, because reversibility changes: a payment rail that adds same-day recall changes the math on what is safe to automate.

The honest limit: tiering does not make a bad model good. It contains the damage a model can do and forces you to be explicit about risk. That is most of the battle. The rest is making sure the numbers under the agent are real, which is the part no autonomy matrix can do for you.

If you are mapping your own workflows to tiers and want to see what each one looks like sitting on a reconciled, source-traceable model, book a demo. Bring your messiest close: that is the one worth testing.