One company policy, signed by finance and risk, that every employee's copilot asks before it writes to the systems that hold the money.
For CFOs and heads of internal controls, the owner of the copilot programme in IT, and the CISO who has to say yes.
Microsoft has sold more than thirty million paid Copilot seats (Microsoft, July 2026), and their connectors now reach the ERP, the CRM and the payment tools under each employee's own identity. The copilot inherits every right the employee has and none of the judgement. A poisoned email reaches the ERP as Maria from accounts.
The controls were written for people. The approval step assumes someone clicking a button, the limit assumes someone remembering it and the audit assumes the person and the action are the same thing. None of that holds when Ben's Claude posts credit notes while Ben sits in a meeting.
Stategram puts one company policy in front of the tools that write: each employee's own limit, one total across every agent and a named person above the line. The copilot asks for a permit and the tool checks it. The receipt names both the person and the agent.
Each person's agent gets the limit the person has, and no more.
Copilot, ChatGPT and Claude draw down the same company total.
Over the limit, the approver the policy names decides.
Your auditor sees who asked, which agent acted and which rule allowed it.
An example written for this page, with round numbers. It uses only what the policy format has today, and it is not a customer's policy.
Inside the rules the agent acts alone. Above a line, the named person decides. Every change to the numbers is a new signed version.
Two weeks, a fixed fee, your limits and a named approver, and the method to do the next workflow yourself.
We will email you to find a time for a 25-minute walkthrough with the founder. No slides, no sales script.
Pick a time in the founder's calendar, or tell us about your agent first.