What You Would Sign
An agent is safe to run unattended when its output can be checked, not when it is accurate. Those are different properties, and only one of them is visible to the person whose name goes on the return.
Lesson 1
Autonomy gates on explainability, not accuracy
The teams deploying accounting agents into real firms found the same thing, and it is not the finding anyone expected: raw accuracy does not determine what you can let run unattended.
A model can be right 97% of the time and remain unusable, because a CPA cannot sign a recommendation they cannot audit. Signing is a legal act. It says I have satisfied myself that this is correct, and "the system is usually right" does not satisfy anyone, least of all a regulator reading it two years later.
So the gate is explainability. An agent's work becomes shippable when every output carries what data was used, why it was mapped that way, and how confident the system is about it. That is not documentation added afterwards for politeness. It is the thing that converts output into something a professional can take responsibility for.
Which means the requirement belongs in the instructions, written by you, before the agent runs. Nobody can add lineage to an answer after the fact.
Lesson 2
The four things a reviewer needs
Lineage. What data produced this. The statement, the account, the transaction id, the row. Without it, checking one figure means redoing the work that produced it, and a control that costs as much as the original work will not be performed.
Reasoning. Which rule was applied. Two defensible treatments produce two different numbers, and both look equally final. A reviewer who cannot see which one was used cannot tell a policy choice from an error.
Confidence. How sure the agent is. This is the one people leave out, and it is the one that does the most work — because without it a near-certainty and a coin flip arrive in the same font, and the reviewer has to treat everything with the suspicion the worst item deserves.
Escalation. What leaves the agent entirely, to whom, and on what trigger. An agent with no exit route resolves every edge case the same way: by continuing.
Miss all four and you have an oracle. Its answers may be excellent. You will not be able to defend a single one of them.
Lesson 3
Instructions that cannot be checked
Ensure the figures are accurate.
Read that as a reviewer. Was it followed? There is no answer. Nothing was produced by following it and nothing is missing if it was ignored. The sentence describes a state of the world you would like to obtain, and dresses it as an instruction.
This is the most comfortable failure in the whole curriculum, because instructions like this make a file look controlled. "Be careful with the cash accounts." "Double-check the mapping." "Use professional judgement on anything ambiguous." A file full of these reads as diligent and contains no controls at all.
The test is one question: could someone else confirm this was followed, without redoing the work?
"Ensure the figures are accurate" — no. "Every figure carries the statement id and line it came from" — yes, in about four seconds, and the check leaves a record.