Probabilistic agents, deterministic money: why the approval line is a feature

There’s a line in the IMF’s April 2026 note, How Agentic AI Will Reshape Payments, that I think should be printed above every agentic-finance roadmap: a tension between probabilistic AI behaviour and the deterministic requirements of payment infrastructures.

That single sentence is the whole reason Fynex is built the way it is. The note frames the shift underneath it well: payments are moving from “click-to-pay” — a human explicitly initiating each transaction — to “decide-to-pay,” where an agent decides and execution happens at machine speed. That’s a genuinely bigger change than it sounds, and it’s why the question of where the human sits stops being a detail and becomes the design. Let me explain what the tension means, why it’s not a solvable-by-better-models problem, and why the human approval step we keep on the settlement boundary is a design choice I’d defend as a feature, not a limitation.

Two systems that don’t speak the same language

An AI agent is a probabilistic machine. Its outputs are likely correct, and getting likelier — but “likely” is the category it lives in. It will, at some frequency, produce an answer that is fluent, confident, and wrong.

A payment system is the opposite kind of machine. Settlement is deterministic and final. There is no “probably paid.” Money either moved or it didn’t, and once it moved on an instant rail, instant means irrevocable — it isn’t coming back because the agent was mistaken. These two systems have opposite tolerances for error, and no amount of model progress collapses the gap. A better agent is still a probabilistic system pointed at a deterministic one.

This is why “the agent will just get good enough to pay autonomously” misreads the problem. The issue was never only accuracy. It’s that the consequence structure is asymmetric: a good decision at the reasoning stage is reversible, and a bad movement at the settlement stage is not.

What the IMF is actually worried about

The note’s risk section is worth reading in full, but the systemic risks are the ones that changed how I think.

Herding and correlation. When many agents run similar optimisation logic, they tend to do the same thing at the same time. The IMF warns this can produce correlated payment flows that arrive together and strain settlement capacity — the payments-world cousin of an algorithmic flash crash. An individual agent behaving reasonably, multiplied across the market, can still add up to a synchronised surge nobody intended.

An expanded attack surface. Agents work by touching lots of external systems, tools and APIs. The note flags that this widens exposure to data exfiltration, tool misuse and cross-system privilege escalation. The more an agent can reach, the more there is to hijack. An agent authorised to move money is a much more valuable target than one that can only read.

Opacity and traceability. When a chain of agent decisions leads to a payment, can you reconstruct why? The note lists traceability and opacity as first-order risks, alongside the legal uncertainty of who is liable when an autonomous action goes wrong.

None of this is anti-AI. The same note is clear that agentic AI can add real value in payments. The point is that the failure modes are systemic and irreversible in a way that ordinary software bugs aren’t — and that “outcomes depend on institutional design and governance as much as technology.”

The approval line, defended

So here’s the choice we made, and why I call it a feature.

Fynex’s agents run the entire reasoning half of finance. They read invoices and match them, reconcile payments into Xero and everything else, forecast cash, catch the duplicate and the mismatch, and build the payout batch fully priced and routed. All of that is the intent work, and it’s reversible — a draft, a proposal, a flag. We let the agent run free there because a mistake costs you a correction, not a loss.

The one act we hold behind a human approval is the one that crosses into settlement. And the reasons are exactly the IMF’s:

• Irreversibility. The approval sits at the only boundary where a mistake can’t be taken back. Guarding the reversible layer would be pointless; guarding this one is the whole game.
• A circuit-breaker against herding. A human on the settlement boundary is, structurally, the thing that doesn’t fire in perfect synchrony with every other agent in the market. It’s a deliberate bit of non-correlation at the exact point the IMF says correlation gets dangerous.
• A smaller attack surface. An agent that can prepare but not release money is a far less rewarding target. Compromising it gets you a proposal a human still has to approve — not a live transfer.
• Traceability by construction. Because every payment is presented to a person as a decision with its reasoning attached, there’s always a human-legible record of why it went out. The audit trail isn’t reconstructed after the fact; it’s the approval step itself.

The honest limit — and why the approval line isn’t the whole answer

I want to be straight about something the IMF is straight about, because it would be a cheap argument otherwise. The note explicitly cautions that a human-in-the-loop is “not sufficient on their own, particularly under time-compressed or clustered failure scenarios.” And it flags a real cost: when payment flows are optimised as a whole, a delay caused by human approval “could unintentionally increase liquidity risks and make risk-hedging strategies less effective.” A person at the door is not a magic safeguard, and it isn’t free.

I agree with both points, and they’re the reason the approval line is one control, not the only one. The IMF’s own list pairs the tiered human-in-the-loop with architectural separation of decision-making from execution, deterministic policy controls, audit trails, and — for the worst case — graduated “kill switches.” Fynex is built on that whole stack, not on a human alone: agents reason in a layer that structurally cannot execute; deterministic rules gate every instruction; the human approval is reserved for what’s material and irreversible, not bolted onto every action. That’s what keeps the approval from becoming either a rubber stamp or a bottleneck. A human on everything would be theatre and would create exactly the liquidity drag the note warns about. A human on the irreversible, material moves — backed by automated controls on the rest — is the version that actually holds up.

”But doesn’t that slow you down?”

It slows down precisely one thing: the irreversible act. Everything upstream of it runs continuously, in the background, at machine speed. What reaches you isn’t a blank payment form — it’s a finished batch with the agent’s reasoning, ready to release. On a prepared run that’s seconds of attention, not hours of work.

Compare that to the alternative the IMF is warning about: full autonomy through settlement, where the first time a human sees a bad payment is after it’s gone. Set against an irreversible loss, a few seconds on approval is not a cost. It’s cheap insurance priced exactly where the risk actually is.

The whole category is going to spend the next few years deciding where the human sits relative to the money. The IMF has now given the clearest official account of why that placement matters more than the model’s raw capability. We placed the human on the settlement boundary before the note came out — and reading it, I’m more convinced that’s where the line belongs. Agentic everywhere it helps; deterministic, approved, and traceable at the one place money becomes final.