Guide

An audit trail for agent payments

28 October 2026

finance · audit · aiagents · accountspayable

This article was created with the help of AI by the Screwtape.ai team. Product details were checked against screwtape.ai/pricing, /docs and /openapi.json on 2026-10-24.

Finance teams already know how to audit a person approving a payment: there is an approver, a timestamp, a policy and a document trail. When an AI agent does the approving, those pieces are often missing. The agent's log says what it did. It rarely shows what was checked, against which rule, and that nobody changed the record later.

Questions an auditor will ask

For any agent-approved payment, expect these:

1. What was the agent about to pay? The invoice, vendor and amount as the agent understood them.
2. What was checked? Required fields, totals, purchase order match, duplicate check, policy limits.
3. What was the result, and when?
4. Who or what allowed the payment to go out? And was that approval tied to this exact payment?
5. Can you show the record hasn't been changed?

An agent's own chat log answers the first question at best.

What a good trail looks like

• One record per decision, written at the time of the check, not reconstructed afterwards.
• Written by something other than the agent. If the agent writes its own audit log, the log is only as trustworthy as the agent.
• Tamper-evident. Each record signed, and linked to the one before, so an edit or a missing entry shows.
• Tied to the payment. An approval should be usable once, for this invoice, this amount and this vendor, and expire quickly.
• Exportable. Your auditor wants a file, not a dashboard login.
• Kept long enough for your retention policy.

How Screwtape.ai does it

Screwtape.ai decides whether an AI agent is allowed to spend money, and keeps the proof. It is a separate check that runs outside your agent.

• Every verdict comes with a signed receipt. You can verify it yourself with POST /v1/receipts/verify or against the public keys at /.well-known/screwtape-receipt-keys.json.
• Receipts can be exported as JSONL, CSV or JSON (GET /v1/receipts/export).
• On the Team plan: 15-minute single-use pass tokens bound to the exact invoice, amount and vendor; linked, tamper-evident audit receipts; policy rules; 1-year receipt retention.
• On Finance Control: the same, plus up to 5 policy sets or entities, unlimited API keys, 7-year receipt retention and an auditor export bundle.

Invoice content is not stored by default. If you opt in on a call, it is kept for 24 hours by default, or for up to 365 days on Team and Finance Control (see screwtape.ai/privacy).

A receipt records what was checked and the result. It does not make the decision right: verdicts come from AI models and automated checks and can be wrong, so keep a person in charge of payments.

Compare the Team and Finance Control plans: screwtape.ai/pricing.