Discussion about this post

User's avatar
Josh Devon's avatar

Love this use case, and I’m curious how you’re thinking about mitigating the lethal trifecta here.

Untrusted input (vendor names, memo fields, invoice text all originate outside the org), sensitive data (GL detail, materiality, JE logic), and external action (writes workpapers, posts to Slack, drafts JEs). All three in one agent puts it at risk for data exfiltration.

Anyone who can submit an invoice can potentially get instructions into a memo or description field the agent reads. And even without an attacker, the agent might get confused or try to be helpful in an unintended way and leak data.

The human reviewer is a good control, but they’re checking output after the agent has already taken action. Subtle manipulation (wrong account, plausible-but-wrong vendor coding) might be hard for a human to catch.​​​​​​​​​​​​​​​​

Byblos Digital's avatar

okay this is the kind of post that makes us want to go rebuild our internal stack tonight. thank you for actually writing out the config-vs-skill split

5 more comments...

No posts

Ready for more?