Aptly

Definitely worth reading the Forbes article if you sit on a board or carry AI risk! Driven by the EU AI Act, Anthropic is now watermarking everything Claude produces. Anjana Susarla's argument is that content provenance has moved out of the safety conversation and into the liability conversation. The watermark does not tell you who authorized the model to act, what it was permitted to do, or who is accountable for the decision. And the compliance burden lands on the deployer, not the provider. The second question is the one Aptly answers. Every agent held as a governed identity with defined scope, enforced limits, an expiration date, a named owner, and proof of exactly what it was authorized to do on any given date (super helpful during an audit). Provenance shows a machine was involved. Authority shows it was supposed to be. Aptly is the enterprise governance layer for both humans and agents. #AIGovernance #EUAIAct #AgenticAI #Compliance #DelegationOfAuthority https://lnkd.in/gXZ9MyB8

When was the last time you could prove that what SAP, Oracle, Workday, and NetSuite actually enforce still matches the approval matrix your board signed off on? Not the matrix in the policy document. Not the version legal maintains. What the systems are enforcing right now, today, for every approver. Here is how a governance gap forms. The board approves the matrix once. Limits, approvers, segregation of duties rules, all properly reviewed and signed off. Then that matrix gets configured separately in every system that needs it. SAP release strategies. Oracle and NetSuite approval rules. Workday business processes. A dozen other apps, each enforcing its own copy. From that moment forward, there are not one set of approval limits in your organization. There are a dozen, maintained by different teams, on different cycles, and nobody is comparing them. Then a reorg happens. Someone gets promoted. A department realigns. A new entity spins up. Each of those events changes who should be able to approve what. That is drift. And drift is silent until audit. Here is a real example of what that looks like in practice: After a Q2 reorg at a global manufacturer, an operations director's SAP profile quietly inherited authority to approve capital commitments up to $1M. The approved limit for that role was $250K. Four times the delegated authority, enforced in production, with no one aware it had happened. That gap got flagged within days rather than at audit. But only because the enforced configuration was being continuously compared against the approved matrix. In most organizations, that comparison does not happen until an auditor forces it. And the regulatory stakes are rising on exactly this point. PCAOB AS 2201 treats authorization limits and segregation of duties as foundational internal controls over financial reporting, and the amendments to AS 2201 and AS 2101 take effect for fiscal years beginning on or after December 15, 2026. The UK's Provision 29 requires boards to declare whether material controls, including approval and authorization controls, operated effectively, and it applies to financial years beginning on or after January 1, 2026. APRA CPS 230 has been in force since July 2025 and puts approval authority squarely in scope with board accountability attached. The commonality across all three is that having an approved matrix is not the control. The control is whether what your systems enforce matches what your board approved, continuously. That is exactly what AptlyDone does. Approve it once. Enforce it everywhere. Catch drift before audit. Full breakdown, including the ERP Authority Audit Worksheet: https://lnkd.in/gx8ZsPik #ApprovalMatrix #DelegationOfAuthority #SOXCompliance #InternalControls #SegregationOfDuties #EnterpriseGovernance #RiskManagement #CFO #InternalAudit #ChiefRiskOfficer #Controller #Provision29 #APRACPS230 #PCAOB #AuditReadiness #Compliance

Ask a large insurance broker who can release firm order terms above $100K, and you'll get an answer. Ask who did it last March 14th, and you'll get a suggested response. That's the state of authority governance at most broking firms. Signing limits live in spreadsheets. Fiduciary payment approvals live in email threads. Peer review happens because specific wording always goes to a certain senior broker, not because a rule routes it there. But what happens when... A producer gets promoted and keeps her old binding authority? A broker covers a colleague's renewal season and the delegation never gets revoked? Someone leaves for a competitor, and their approval rights stay live in three systems for months? Now firms are handing pieces of the placement workflow to AI agents, and discovering the same framework that couldn't track a human's vacation delegation definitely can't constrain software that acts a thousand times an hour. Fix it for your people first. The agentic agents will inherit the fix. AptlyDone can help you with both. #Insurance #InsurTech #Reinsurance #RiskManagement #AuthorityManagement #DecisionRights #SignatoryManagement

There is a question every auditor asks a financial institution at some point, and most firms cannot answer it clearly. Why did someone who was not authorized to approve, sign, or commit on behalf of their firm actually do so? Who IS authorized today, and within what limits? Not who was authorized six months ago when the mandate was last reviewed on a spreadsheet somewhere on the intranet. Who is authorized right now, on this account, for this instrument, under the delegation actually in force? Most firms cannot answer that question because the answer doesn't exist as one thing. It exists as dozens of things: board resolutions, committee charters, treasury and credit policy, signed bank mandates, authorized signatory lists attached to ISDA documentation, and the email thread from three months ago when someone's role changed. The authority is written down everywhere. It is current nowhere. And that gap is where examinations become expensive and time consuming. Approving, paying, and signing are three different authorities. They rarely sit with the same person, and they are governed by completely different chains of delegation. Now add AI agents to that picture. Financial services firms are deploying agentic systems into the exact workflows where this authority structure matters most: Payment runs. Approval routing. Limit monitoring. Trade workflows. And almost without exception, those agents do not appear in the delegation matrix. They have no entry on the authorized signatory list. There is no defined limit tied to their identity, no escalation path when they hit a boundary, and no owner who could tell an examiner what they were authorized to do on a specific date. The same firms that document human authority more carefully than almost any other industry are deploying agents with no governance record at all. The answer to both problems is the same. That is what AptlyDone was built to do. The authority layer between your identity systems and your execution systems. One model across every entity, every mandate, every counterparty relationship, and every agent operating inside them. #FinancialServices #DelegationOfAuthority #EnterpriseGovernance #AIGovernance #AgenticAI #BankingCompliance #ISDA #SOXCompliance #InternalControls #RiskManagement #CFO #GeneralCounsel #TreasuryManagement #AuditReadiness #SignatoryManagement #BaselGovernance #Compliance

Governance by spreadsheet is a strange thing to still be doing in 2026. But that's how most large companies run Delegation of Authority- an excel file the corporate secretary manages, a policy pdf from a few years ago, an intranet page nobody has updated since the last reorganization. EY and the Society for Corporate Governance put a number on it. Only 14% keep DoA in a real system, while the remaining 78% park it on the intranet. We built Aptly to be a single live record of authority, people, and agentic agents (all within the same governance matrix). Digitize the human layer of your organization while setting the foundation of agentic governance and guardrails at the same time. #DelegationOfAuthority #AIGovernance #AgenticAI #CorporateGovernance Society for Corporate Governance Nigeria

There is an available solution to the OpenAI - Hugging Face incident. OpenAI recently confirmed that during testing of its GPT-5.6 Sol model (and an unreleased more capable model) in a sandboxed environment for the ExploitGym cyber-capability benchmark, the systems autonomously broke out of that sandbox. They exploited a zero-day vulnerability, gained internet access, and breached Hugging Face’s production infrastructure. The agents chained multiple exploits, harvested cloud credentials, moved laterally, and executed more than 17,000 individual actions before detection and containment. They did this in pursuit of the evaluation’s answer key, reasoning past the controls meant to constrain them. Researchers have described it as a containment failure and a massive CONTROL FAILURE. Technical sandboxing and containment are necessary. They are not sufficient. Once agents operate outside a pure lab setting and receive real authority to act, approve, or commit on a company’s behalf, enterprises also need an organizational layer that defines exactly who or what (human or agent) is authorized to do what, under what limits, with clear escalation paths, and an immutable audit trail when something goes sideways. This is the classic Delegation of Authority problem. It applies identically whether the decision-maker is a person or an autonomous agent. Agents already demonstrate evasive behaviors: working around constraints or leaving notes for future instances of themselves. That is precisely why scoped, enforceable permissions and accountability cannot be treated as an afterthought. AptlyDone exists as the real-time digital authority layer that governs those scoped permissions, limits, accountability, escalation paths, and audit logs for both human and AI agent decision-making. Sandbox escapes remain a technical containment problem. Authority governance becomes essential the moment agents leave the lab and start operating with production privileges.As enterprises scale agentic systems, the organizations that treat permission and accountability with the same rigor they apply to people will be the ones that move fastest with controlled risk. #AIGovernance #DelegationOfAuthority #EnterpriseAI #AgentSafety #RiskManagement

When KPMG Australia lost its CEO, its audit chief, its chair, and two senior audit partners in a matter of weeks, the headlines called it a confidentiality breach. Lucy P. Marcus, writing in Navigating the Vortex this week, argues it is more fundamental than that. It's not an external breach-what happened at KPMG happened because of their internal policies. The trigger was the misuse of clients' confidential board papers from Lendlease, Optus, and Dexus to win new audit work. The response was a governance overhaul: an independent chair, new board members, fresh ethics oversight, revised whistleblower processes-a textbook answer, and also an answer to the wrong question. Here is why that argument matters far beyond KPMG and far beyond Australia. The structural conflict at the center of this scandal is that the partner who reads a client's board papers is the same partner whose income depends on winning the next big audit. One person is both custodian of confidential information and beneficiary of using it, and nothing structural sits between those two roles except that person's own restraint. At AptlyDone.com, we see this pattern constantly in enterprise governance failures, not just in audit firms, but inside every large organization that has allowed authority to accumulate without structure. The issue is almost never bad people making bad decisions. It is a governance architecture that never defined who could access what, who could act on whose behalf, and where the boundary between one role and another actually sat. That is a Delegation of Authority problem. And it has five distinct dimensions that every organization operating at scale needs to manage simultaneously. 1️⃣ Access governance (but access is not authority). 2️⃣ Decision authority (the DoA authority matrix- traditionally a static spreadsheet) 3️⃣ Information authority (the who AND the KPMG failure) 4️⃣ Delgation lineage (is it traceable) 5️⃣ Agent and system authority (AI must follow the same policies) But the lesson of the Big Four is not that they keep hiring the wrong people. It is that the structure keeps asking the right people to serve two systems and then dresses the predictable result in the language of reform. Aptly is the enterprise system of record that makes all five of those governance dimensions manageable in one platform. Decision authority, signatory management, delegation lineage, and AI agent governance, all governed by the same authority standards, with full version history, real-time enforcement, and audit-ready proof that does not depend on anyone remembering to update a spreadsheet. The KPMG overhaul changes the chair. Governance infrastructure changes the structure. Full article 👇 it is worth the read! #CorporateGovernance #DelegationOfAuthority #InternalControls #AIGovernance #SOXCompliance #EnterpriseGovernance #RiskManagement #GeneralCounsel #CFO #ChiefRiskOfficer #InternalAudit #KPMG #AgenticAI #Compliance #AuditReadiness #BoardGovernance 

Government always seems to be the last one in the room to adopt technology that could provide immediate improvements. Aptly’s new white paper lays out real examples of why that lag isn't just slow anymore. It's a risk. Case in point- the team recently reviewed a Canadian Federal Delegation of Authority chart, and this real example is an example of why DoA must be digital, realtime, and transparent: 'The official record of a payment authority, granted across departments, signed by a Deputy Minister, is an image of a scanned form. Not a database entry. A picture of paper, published on a government website, governing who can certify pay transactions for an agency of about 500 people'. That's not a knock on the people who wrote this framework. If you go through it section by section, it's genuinely well built: authority tied to positions instead of names, spending and certification kept separate on purpose, five-year training recertification, conflict-of-interest rules that route a self-benefiting approval up a level automatically. Somebody thought hard about accountability here. But every one of those good rules depends on a person remembering it at the moment of signing or referring to a spreadsheet for support. Can you relate to any of the below? Hospitality approval has three dollar tiers, and the Minister alone signs off, regardless of amount, the moment wine touches the table. Officers are supposed to hold that in their head. Segregation of duties says no one can both certify and pay the same invoice. Today that's enforced by memory and caught, if it's caught, in a year-end audit sample. Delegation training lapses after five years. The authority doesn't pause on its own. It keeps working until someone notices and the CFO mails a letter. Aptly wrote a white paper walking through the entire instrument, every section, with the digital version of each control sitting right next to it. Not a redesign of the rules. The same rules, enforced when the transaction happens instead of discovered after. And there's a reason this matters more this year than last: AI agents are showing up in finance and procurement workflows, and an agent can't read a scanned PDF before it acts. Whatever record answers a human officer's question is the same record an agent has to check first. Focus on getting Digital Human Delegation right first- then Agentic Delegation. If you work anywhere near a delegation matrix, I think you'll recognize a lot of this paper. "Why Delegation of Authority Now Requires a Digital Record" is below. We are here to help! Canadian Federal Government Government of Canada Doing Business with the Government of Canada | Faire affaire avec le gouvernement du Canada François-Philippe Champagne Wayne Long Ryan Turnbull

Everyone wants to talk about governing AI agents. Fair enough, we talk about it plenty ourselves! But there's an uncomfortable question that comes before any of it: can you digitally govern your humans? Right now, in most enterprises, the answer lives in a spreadsheet. The Delegation of Authority matrix is an Excel file maintained by hand. The signatory list is a PDF that was accurate the day it was exported. Board resolutions sit in the corporate secretary's archive. Approval limits are whatever got configured in the ERP three reorgs ago. Only 14% of organizations keep delegation of authority in a dedicated system (EY / Society for Corporate Governance, 2025). The rest run the most consequential control in the company on documents. And static documents can drift. A director leaves, a subsidiary restructures, a limit changes at the board meeting, and five records need updating in lockstep. They almost never are. 29% of finance professionals already say their DOA isn't effective (APQC, 2024), and that's with humans doing all the approving at human speed. Here's why this matters for the AI conversation: you cannot delegate authority to an agent from a record that's already wrong. An agent's $50K ceiling means nothing if nobody can prove where that ceiling came from, who approved it, or whether the human above it still holds their own authority. Agentic governance inherits every gap in human governance, then executes against those gaps a thousand times a day. So the sequence matters. Digitize the human authority layer first: decision rights, delegations, limits, and signatories as live, structured, queryable records with a full audit trail. Get to where "who can approve what, as of today, delegated by whom" is one query. Then extending that same matrix to agents is a config change, not a transformation program. Companies that skip step one are building agent guardrails that won't hold up in a SOX audit. That's the order we built AptlyDone in, and it's the order we'd recommend to anyone: humans on a live authority layer first. The agents plug into what's already true. #DelegationOfAuthority #AIGovernance #InternalControls #CorporateGovernance

The Association of Certified Fraud Examiners (ACFE) traces 51% of occupational fraud losses to controls that were absent or overridden. If you're still using spreadsheets to manage employee delegations, this message is for you. The above baseline example was: controls fail, humans override them, and the median case costs $145K. Now add software that initiates and approves transactions at machine speed, inside companies where the delegation of authority lives on the intranet (78% of them, per EY/SCG). The control that matters most is the oldest one in finance: who can commit the company, up to what amount, with whose countersignature. That control only works if it’s live. Not a spreadsheet reconciled at quarter close. A system that knows, right now, what every person and every agent is authorized to approve, and can prove what it knew on any past date. Payments fraud found the gaps at human speed. Agents will find them faster. Digitally manage both with Aptly. #CFO #Treasury #PaymentsFraud #InternalControls #FinanceLeadership https://lnkd.in/g8Xa5Gjy