Controls
The agent proposes. People approve.
Agents are fast, so the controls are built into the ledger rather than added on top. Approvals route by amount and role, the person who proposes cannot approve above a threshold, entries are reversed and never deleted, and the log only grows. The ledger is built to be audited.
- Full export, any timeComplete history in standard formats, with no exit fee.
- Hosted in TorontoGoogle Cloud's northamerica-northeast2 region, under Ontario law.
- Client isolationAnother client's record is never visible, and a request for one looks like a request for nothing.
- Custom rolesPermissions you define, assigned per person and per company.
What you get
Every change is a proposal
Whether a person, an agent or an import started it, a change waits in the review queue with its source until a named person approves it.
Authority follows the amount
Thresholds route a proposal to a bookkeeper, a senior or a controller, per entity, and a second person is needed above the line you set.
History cannot be rewritten
Entries are reversed by correcting entries, periods lock, and the audit log is append-only. Nothing is deleted to make a number fit.
How it works
Every control, in the order a change meets it.
Pick a step to see it. The panel stays beside you while you read.
Material entries always need a human. Each proposal shows who or what drafted it, the evidence behind it and the person it is waiting on. Approvals and rejections are attributed by name, and there is no anonymous system actor.
- Evidence attached to each proposal
- Named attribution on every approval
- Immaterial recurring entries can auto-approve under a threshold you set
Review queue
Thresholds are set per entity and written in plain English. A small bill goes to a bookkeeper, a larger one to a senior, and a payment run to a controller. Spend limits apply inside every payment run as well.
- Thresholds per entity
- Rules in plain English
- Spend limits in every payment run
Approval thresholds, Harbourline Ontario
| Amount | First approver | Second approver |
|---|---|---|
| Under 2,500.00 | Bookkeeper | None |
| 2,500.00 to 25,000.00 | Senior accountant | None |
| Over 25,000.00 | Controller | Finance director |
A clerk who queues a payment and a controller who releases it are different permissions, not a convention. Above the threshold, the person who proposed a change cannot be the one who approves it, and banking changes need a second person.
- Proposer cannot approve above the threshold
- Banking changes need a second person
- Enforced at the queue, not left to habit
A payment run
- ProposedMaria, bookkeeperInfo
- Blocked for MariaShe cannot approve her own runWaiting
- ApprovedDev, controllerDone
- ReleasedBanking change needs a second personDone
A posted entry is corrected by a reversing entry that sits beside the original, so the books show what was posted, what changed and who changed it. Nothing is deleted.
- Corrections are new entries
- The original stays visible
- Both are attributed
Entry JE-1042, corrected
- Original entry, 12 October
- 1,200.00
- Reversing entry, 1 November
- (1,200.00)
- Net effect
- 0.00
Close a period and nothing can post into it. A late item needs the period reopened by someone with the authority to do it, and the reopening is in the log.
- Locks per entity and period
- Reopening needs authority
- Every lock and every reopening is logged
September
- OpenEntries post as usualInfo
- LockedNothing posts into SeptemberDone
- Late billProposed against October insteadWaiting
Who proposed, who approved and when. The log only grows, auditors get a seat that reads the same log, and any statement figure drills down to the entry and the source document behind it.
- Statement to entry to source document
- A read-only auditor seat
- Agent and approver recorded together
Audit log
| When | Who | Action |
|---|---|---|
| 14 Oct, 09:12 | Eternify Assistant | Proposed bill NS-2210 |
| 14 Oct, 09:40 | Maria Santos | Approved bill NS-2210 |
| 14 Oct, 09:40 | System | Posted entry JE-1051 |
Review queue
Approval thresholds, Harbourline Ontario
| Amount | First approver | Second approver |
|---|---|---|
| Under 2,500.00 | Bookkeeper | None |
| 2,500.00 to 25,000.00 | Senior accountant | None |
| Over 25,000.00 | Controller | Finance director |
A payment run
- ProposedMaria, bookkeeperInfo
- Blocked for MariaShe cannot approve her own runWaiting
- ApprovedDev, controllerDone
- ReleasedBanking change needs a second personDone
Entry JE-1042, corrected
- Original entry, 12 October
- 1,200.00
- Reversing entry, 1 November
- (1,200.00)
- Net effect
- 0.00
September
- OpenEntries post as usualInfo
- LockedNothing posts into SeptemberDone
- Late billProposed against October insteadWaiting
Audit log
| When | Who | Action |
|---|---|---|
| 14 Oct, 09:12 | Eternify Assistant | Proposed bill NS-2210 |
| 14 Oct, 09:40 | Maria Santos | Approved bill NS-2210 |
| 14 Oct, 09:40 | System | Posted entry JE-1051 |
Architecture
One gate for every route in.
People, agents, imports and the API all pass through the same checks before anything reaches the books.
Who proposes
- A person
- Eternify Assistant
- Your agent, through MCP
- An import or the API
The gate
- Review queue
- Routing by amount and role
- Segregation of duties
The books
- Posted entries
- Period locks
- Append-only audit log
Capabilities
Also built in
Full export, any time
Complete history in standard formats, with no exit fee.
Hosted in Toronto
Google Cloud's northamerica-northeast2 region, under Ontario law.
Client isolation
Another client's record is never visible, and a request for one looks like a request for nothing.
Custom roles
Permissions you define, assigned per person and per company.
Keep going with the rest.
Eternify Assistant
Assistant, agents and continuous work, with a named person approving every change.
Learn moreMCP connector
Your books in Claude, ChatGPT or any agent that speaks MCP.
Learn moreGeneral ledger
Always current, with every entry traced to its source.
Learn more
Questions
Questions, answered.
What controls should AI in accounting have?
At minimum, the AI proposes and a named person approves, authority routes by amount, the proposer cannot approve their own work above a threshold, entries are reversed rather than deleted, and the audit log is append-only. Eternify Ledger enforces each of these in the ledger, not in a policy document.
What is segregation of duties in accounting software?
It is the rule that no one person controls a transaction from start to finish. In Eternify Ledger the queue enforces it: above a threshold the person who proposed a change cannot approve it, and banking changes need a second person.
Can a posted journal entry be deleted?
No. A posted entry is corrected with a reversing entry that sits beside the original, and both stay in the books and the audit log.
Where is our data held, and can we take it with us?
In Canada, in Google Cloud's Toronto region. You can export the full history in standard formats at any time, with no exit fee.
See the controls on a working ledger.
We walk a proposal from an agent to a posted entry, and show you the log it leaves.