What breaks first when you hand AI your books

Everyone asks me whether the AI will miscategorize transactions. Almost nobody asks the questions that matter. After running a fleet on 30 sets of books under management, here's my honest list of what actually breaks — in the order it breaks — and what catches each one.

1. Logins break before bookkeeping does

The single biggest failure class isn't judgment. It's access. Bank sites time out sessions, force password rotations, and throw two-factor prompts at odd moments. A bot mid-reconcile that loses its session doesn't do bad bookkeeping — it does *no* bookkeeping, and the difference matters: the first one corrupts your books, the second just costs you a day.

The guardrail: bots sign themselves in, 2FA codes route to a channel the fleet reads, and a hard stop — like a CAPTCHA — becomes a flagged item for a human instead of a retry loop. Access failures should be loud, fast, and boring.

2. Silent failures beat wrong answers

Here's one from my own operation. My LinkedIn posting pipeline — same fleet, different job — failed quietly for four straight days because a vendor retired an API version. Every daily log said "will retry next run." Nothing was wrong enough to scream. That's the shape of the real risk: not a bot doing something bad, but a bot doing *nothing* while reporting that everything's fine.

The guardrail is a verification habit, not a smarter bot: every automated job gets an independent check that reads the *result* (the posted item, the reconciled balance, the filed report), never the job's own log. A log says what the code tried. Only the outcome says what happened.

3. The edge case that was really a policy question

A bot working a bank feed will eventually hit a deposit that could be a loan, an owner contribution, or income. The failure isn't that AI picks wrong — it's letting it pick at all. On my fleet, ambiguity converts to a client question automatically. The bots are allowed to be uncertain; they're not allowed to be silently certain.

That rule has a compounding benefit: every question a client answers becomes a written rule the fleet applies forever. The book gets more automated *because* the bot asked.

4. Reconciliation is the tripwire that catches everything else

Whatever slips past the first three layers gets caught at reconcile time, because a reconciliation either ties to $0.00 or it doesn't. My standing rule: bots finish only perfect ties. A difference of four cents doesn't get "adjusted" — it gets left, flagged, and a human looks. In one close week the fleet reconciled 30+ accounts to zero; the ones that didn't tie are precisely the ones I wanted human eyes on.

What this means if you're starting

Don't start by asking "how smart is the AI?" Ask:

• What happens when a login dies mid-job?
• How would I know if a job silently stopped running?
• Where does ambiguity go — a guess, or a question?
• What's the tripwire that catches everything else?

Get those four answers written down and the categorization accuracy takes care of itself. That's the actual difference between a demo and an operation.

*This is the kind of thing we work through every week inside Pennyworth — real failure logs from a real fleet, not vendor promises.*