Cross-tenant reads, unattributed entries and AI-initiated payments are not prevented by settings. There is no code path that performs them.
An organization's chart, journal and engines are checked against each other when they are built. A cross-org read is a thrown error, not a filtered query someone can forget.
Every entry, approval, waiver and reopening names the person responsible. An agent's proposal, once approved, is attributed to the approver.
No payment tool exists in the registry. Not disabled by a flag — never written.
Reaching an organization requires both its id and a membership. Access is denied by default rather than granted by default.
View reports, view payroll, approve payments and access the assistant are distinct capabilities checked before a request runs.
An append-only, per-organization event trail. Nothing in it can be edited, and reopening a closed period or waiving a close task is recorded with its stated reason.
The persistence layer lists every command that can change state. Anything not on the list is refused rather than executed, so the surface that survives a restart is a list you can read.
The assistant's answers are gated by a verifier before display. An unverifiable figure is never rendered, even once.
Categorisations, accruals and every agent proposal are drafts until a person approves them, and the resulting entry carries their name.
The demo runs on a seeded company with a live close waiting — two real blockers and agents holding proposals.