Control starts by separating roles

Thesis: useful finance automation requires explicit separation between probabilistic interpretation, deterministic validation, accountable human authority and execution of an approved action.

An AI system can extract fields from an invoice, classify a document and propose an account. Those outputs can be useful without being authoritative. Extraction does not establish that a supplier is legitimate, a tax treatment is correct, an exception is acceptable or a posting should occur. A fluent explanation does not convert a probabilistic output into a control decision.

The role model used in this article is deliberately concise: AI interprets. Norquantia validates. Humans govern. ERP executes. “Norquantia validates” describes a public conceptual control layer: explicit data contracts, deterministic checks, evidence and rule references. It does not imply that every transaction can be resolved by a rule, that Norquantia Flow currently posts automatically, or that human review makes every use safe.

Definitions for a controlled automation boundary

AI interpretation
A probabilistic transformation of evidence into proposed fields, classifications or explanations. The output may be useful and still uncertain.
Validation
Testing a supplied value or relationship against an explicit contract, rule or required condition without silently inventing missing facts.
Deterministic control
A repeatable test that produces the same result for the same normalized input and rule version, with traceable evidence.
Human oversight
A designed ability for a person to understand relevant information, monitor performance and intervene where the role requires it.
Human authority
The assigned right and accountability to approve, stop, redirect or escalate an action.
Exception
A condition that cannot proceed under the normal control path because information, confidence, policy or rule conditions are unresolved.
Audit trail
A retained record of source evidence, transformations, control results, rule versions, decisions, actors and timestamps sufficient to reconstruct the path.
ERP execution
The creation or change of an operational transaction in an enterprise system after the required approval boundary has been met.
Automation bias
The tendency to over-rely on an automated recommendation or to reduce independent checking because the system appears authoritative.
Control before posting
The principle that material validation and approval occur before an action is released toward operational execution.

Invoice extraction is not transaction control

Invoice extraction answers a representation question: what text, amount, date or supplier identifier appears to be present? Transaction control asks different questions: are required fields present, do monetary relationships reconcile, does the proposed treatment match explicit policy, is the supplier context valid, and who may approve the exception?

Conflating these questions creates a control gap. An extraction model can be confident about a value that is contextually wrong. It can also be uncertain about a value that a simple deterministic relationship resolves. The architecture should retain both states rather than compressing them into one confidence score.

Interpretation proposes; validation tests

Interpretation is well suited to ambiguous evidence: document layout, language variation and unstructured descriptions. Validation is well suited to explicit relationships: required formats, arithmetic, allowed mappings and documented decision conditions. Neither role should silently perform the other.

When a rule is not applicable or information is missing, the result should remain visible. A REVIEW state is not a technical failure; it is a governance instruction that an accountable person must examine a material uncertainty. A FAIL state should identify the violated condition. A PASS state should mean only that the executed checks passed—not that every legal, tax or business question has been answered.

The role-separation model

The model places a controlled boundary between evidence and operational consequence. AI proposes a normalized representation. Deterministic controls test what can be tested explicitly and attach rule references. A human role evaluates material exceptions with authority to intervene. Only an approved action becomes ERP-ready.

This separation reflects a broader finding from human-automation research: automation can support information acquisition, analysis, decision selection and action implementation at different levels, and the appropriate level should be chosen rather than assumed [4]. Bainbridge’s classic analysis also warns that automation can change and sometimes intensify the human operator’s remaining work [5].

Automation levels change consequences

A system that highlights a possible duplicate has a different consequence from one that selects an account, releases a payment or posts a journal. The same model accuracy can therefore create different risk depending on the action boundary, reversibility, value, frequency and affected control.

Governance should specify which function is automated, what evidence the person sees, how uncertainty is displayed, what happens when the person disagrees and how the action can be stopped. Amershi and colleagues’ human-AI interaction guidance emphasizes designing for understandable system behavior, efficient correction and appropriate feedback across the interaction lifecycle [6]. Those principles become control requirements when an output can influence finance operations.

Human oversight must be meaningful

A final approval click is not meaningful oversight if the reviewer lacks information, competence, time, authority, ability to intervene or clear accountability boundaries. The reviewer must see the source evidence, the proposed normalization, applicable control results and unresolved uncertainty at a level proportionate to the decision.

The EU Artificial Intelligence Act requires effective human oversight for high-risk AI systems and describes capabilities such as understanding system limitations, avoiding automatic reliance, interpreting outputs and deciding not to use or to override them [1]. This article does not classify every finance-automation use case as high-risk and is not legal advice. Article 14 is used as an authoritative illustration of what effective oversight can require in its legal scope.

NIST’s voluntary AI RMF frames risk management across governance, mapping, measurement and management, while its Generative AI Profile identifies risks and suggested actions specific to generative AI [2] [3]. Koulu cautions that human oversight can become an empty procedural shell when its limitations and the substance of discretion are ignored [7]. Together, these sources support designing the human role, not merely inserting one.

Illustrative scenario

A cross-border invoice with material uncertainty

This composite example is illustrative and is not based on a named client. A supplier invoice arrives from another country in a foreign currency. An AI service extracts the supplier name, invoice date, currency, line descriptions, net amount, tax amount and total. It proposes a supplier match, VAT treatment and account mapping.

Three uncertainties remain. The supplier identifier resembles two records. The document’s tax wording is ambiguous. The proposed account is plausible but inconsistent with the purchase-order category. The organization could accept the extraction confidence as a proxy for approval, or separate interpretation from control.

Under the separated model, the extracted source values and normalized values are retained. Deterministic checks test arithmetic and required fields; they do not infer the tax conclusion. The supplier and account mismatches trigger explicit REVIEW diagnostics. A qualified reviewer sees the invoice evidence, proposed matches, rule results and policy references. The reviewer has authority to reject the supplier match, request clarification or approve the transaction under the documented control path.

The result is classified as PASS, FAIL or REVIEW for each control, not as a single opaque score. Only after material exceptions are resolved does an approved transaction become ERP-ready. The scenario does not claim live automatic ERP posting. Evidence, rule versions and the human decision are retained in an audit trail. The management lesson is that automation should reduce interpretation effort while making decision authority more visible—not hide uncertainty behind a final click.

A control path before ERP execution

Control flow from transaction evidence through AI interpretation and deterministic validation to pass, fail or review, followed by human authority, approved ERP-ready action and an audit trail.
Norquantia conceptual control model based on the sources cited in this article. It separates interpretation, deterministic validation, human authority and approved ERP execution. It does not claim current automatic ERP posting or empirical validation.

NAIOS™ governance principles

The public Norquantia AI Operating System — NAIOS™ describes an organizational governance and operating model, not a conventional computer operating system or standalone software product. Its principles—explicit authority, accountable human ownership, controlled context, evidence and traceability, risk-proportionate oversight, confidentiality boundaries and verification before action—provide the governance layer around the control path.

Within the Norquantia Transformation System™, those principles should be considered during discovery, design and implementation, then tested through adoption, optimization and learning. Oversight that is added after the interface and operating roles are fixed is harder to make meaningful.

Norquantia Flow boundaries

Norquantia Flow is a separate private-beta product. Its public direction is controlled decision support for invoice and transaction validation. The conceptual model in this article may inform that direction, but it is not a claim that every depicted capability is in production or that Flow performs live automatic ERP posting.

The boundary matters: a product can present normalized evidence, deterministic results and review states without claiming authority over tax treatment or management decisions. Product-stage language should remain aligned with what is visibly available and manually verified.

Auditability and exception handling

An audit trail should make the decision reconstructable: original source, normalized representation, model or service version where relevant, executed rule set, status, diagnostic evidence, human action and release boundary. Logging only the final approval loses the reasoning path; storing only model prompts may lose the operational control context.

Exception queues also need ownership and service expectations. High volumes of REVIEW can indicate weak source data, poorly scoped automation or controls that are too broad. Repeated overrides can indicate a rule problem or a governance problem. Learning should improve the model and the operating design without silently rewriting historical evidence.

Founder perspective — draft for approval

Magnus Ove’s perspective

Magnus Ove’s view is that human review should not be added as a ceremonial final click. The reviewer must receive evidence, understand the control result and have real authority to stop or redirect the transaction.

Management questions for finance automation

  • Which function is interpreting evidence, and which function is making a control decision?
  • What does PASS mean, and which questions remain outside the executed rules?
  • Who can stop, redirect or approve a material exception?
  • What evidence and uncertainty does that person see?
  • How are source and normalized values retained separately?
  • Which action boundary prevents unapproved ERP execution?
  • How are repeated REVIEW and override patterns analyzed without rewriting history?
  • Has legal classification been assessed separately rather than inferred from this management model?

Assessment and advisory connections

An AI Readiness Assessment can test whether purpose, data, control design, authority and operational capability support a defined use case. The AI Readiness and Governance for Finance service connects the use-case portfolio to an accountable operating model. Cross-border Finance Systems is relevant where country, entity and system boundaries affect the evidence and decision path.

References

  1. European Parliament and Council of the European Union (2024), “Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence,” Official Journal of the European Union, especially Article 14. Official EUR-Lex text.
  2. Elham Tabassi (2023), “Artificial Intelligence Risk Management Framework (AI RMF 1.0),” National Institute of Standards and Technology, NIST AI 100-1. https://doi.org/10.6028/NIST.AI.100-1
  3. Chloe Autio, Reva Schwartz, Jesse Dunietz, Shomik Jain, Martin Stanley, Elham Tabassi, Patrick Hall and Kamie Roberts (2024), “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile,” National Institute of Standards and Technology, NIST AI 600-1. https://doi.org/10.6028/NIST.AI.600-1
  4. Raja Parasuraman, Thomas B. Sheridan and Christopher D. Wickens (2000), “A model for types and levels of human interaction with automation,” IEEE Transactions on Systems, Man, and Cybernetics — Part A: Systems and Humans, 30(3), 286–297. https://doi.org/10.1109/3468.844354
  5. Lisanne Bainbridge (1983), “Ironies of automation,” Automatica, 19(6), 775–779. https://doi.org/10.1016/0005-1098(83)90046-8
  6. Saleema Amershi et al. (2019), “Guidelines for Human-AI Interaction,” Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems, Paper 3, 1–13. https://doi.org/10.1145/3290605.3300233
  7. Riikka Koulu (2020), “Proceduralizing control and discretion: Human oversight in artificial intelligence policy,” Maastricht Journal of European and Comparative Law, 27(6), 720–735. https://doi.org/10.1177/1023263X20978649

Norquantia distinguishes legal and institutional requirements, peer-reviewed research and its own management interpretation. This article is not legal advice. The conceptual model and practical scenario are Norquantia syntheses.