Free Workbench · Resource-first

Build from the evidence.

Blueprints, safeguards and living workflows for owners who want to apply AI without handing over judgement, financial authority or uncontrolled access.

Free accessNo community feedLiving resourcesHuman-controlled

Workbench / live resourcesApply with a handbrake

Launch resources

Receipt Reconciliation Agent

The operating loop, matching rules, authority boundary, audit record and first-period scorecard.

8-step operating loop2 working tablesPrint-ready scorecard

Blueprint v0.1 → 02

Find Your First AI Agent

A practical filter for finding repetitive work with clear inputs, a useful outcome and a safe human gate.

7 readiness checksRisk boundary promptFirst-job filter

Decision worksheet → 03

Safe Agent Access Checklist

Define least access, allowlisted destinations, prohibited actions, monitoring and revocation before launch.

10 controlsHuman takeoverRevocation check

Control checklist →

Open the Workbench

Name and email. Immediate access.

The resources are free. Registration keeps the blueprint, safeguards and future changes connected in one place.

Blueprint 01 · v0.1

Receipt Reconciliation Agent

A platform-agnostic design for keeping company-card receipts under control without giving an agent authority to make payments, change accounting records or send arbitrary messages.

Use the pattern, not the product. Sammi inside Grok Bot is the real case study, not a required platform.

Good fit

Missing receipts recur every week or month.
The transaction source can be reviewed safely.
Documents usually exist in email or an approved supplier portal.
There is one controlled internal destination for accounts documents.
A human can handle uncertainty and access decisions.
The business can retain an audit trail.

Do not automate first when there is no agreed recipient, access inventory, authority boundary or reliable way to recognise the correct document.

Operating loop

Move routine evidence. Escalate uncertainty.

Run a scheduled morning check.

Read approved transaction and reconciliation information.

Identify items without acceptable evidence.

Search approved email sources, then approved supplier portals.

Validate supplier, date, amount, currency, document quality and duplicates.

Deliver routine matches to one allowlisted internal destination.

Record the action and return uncertain or blocked items to the owner.

Report when the actionable queue is clear.

Source inventory

Map access before connecting tools.

Complete the inventory without storing credentials in it. Secrets belong in a proper secrets manager.

An operator workbench with plans, evidence sheets, a tablet and measuring tools — Map the work before connecting the toolsSources / rules / owner

Source	What it contains	Access method	Read?	Download?
Company-card portal	Transactions and statement state
Work email	Supplier invoices and receipts
Supplier portal	Invoice archive
Accounts destination	Controlled internal channel	Allowlisted route	N/A	N/A

Matching rules

Check	Routine match	Exception
Supplier	Recognised identity or approved mapping	Unknown or ambiguous
Date	Inside declared tolerance	Outside tolerance or unclear
Amount	Exact or inside approved tolerance	Difference outside policy
Currency	Matches transaction	Mismatch or unclear conversion
Document	Readable valid invoice or receipt	Broken, incomplete or unrelated
Duplicate	Not already delivered	Existing or conflicting document

Never invent tolerances. Finance or the business owner must declare them.

Authority matrix

Write the handbrake before the automation.

Agent may

Read approved transaction information.
Search approved mailboxes and portals.
Download and compare a likely document.
Deliver routine matches internally.
Record outcomes and exceptions.

Agent must stop

Identity or evidence is uncertain.
New access or a new recipient is required.
A document is broken or inconsistent.
Another person holds the source document.
The action falls outside the routine.

Agent must never

Make or approve payments.
Change bank or supplier details.
Make VAT, tax or coding judgements.
Send to arbitrary recipients.
Guess when evidence is missing.

Owner needs

Watch: see the live work.
Decide: answer bounded exceptions.
Status: see completed, gated and unresolved outcomes.

Implementation

Read-only first. Delivery last.

Map the manual process and collect a small redacted evidence set.
Define the approved sources and internal destination.
Write matching and exception rules before connecting tools.
Run read-only discovery and compare it with a human.
Add document download with an audit record.
Add delivery only to the allowlisted internal destination.
Test duplicates, broken documents, unknown suppliers and missing access.
Run supervised checks until exception behaviour is trusted.
Keep the takeover path and review authority regularly.

Minimum audit record

Check time, safe transaction reference, sources searched, match outcome, document reference or hash, delivery outcome, duplicate decision, exception category, human decision and final state.

First-period scorecard

Measure after a complete statement period.

Measure	Baseline	Current period	Verdict
Missing-receipt chase messages
Transactions needing manual search
Receipts found without owner involvement
Exceptions requiring the owner
Approximate owner minutes
Items still missing at close
Wrong matches or unsafe attempts
Duplicate sends avoided

Playbook 02

Find Your First AI Agent

Start with work that is repetitive, observable and reversible. The first agent should reduce pressure without inheriting a business-critical decision.

The job recurs weekly or monthly.
The inputs and useful output can be described plainly.
A person already knows how to judge a correct result.
The agent can begin read-only.
Routine actions can be separated from exceptions.
A named human can approve or take over.
Failure is visible and recoverable.
The result can be measured after a complete period.

If you cannot define what the agent must never do, the job is not ready.

Checklist 03

Safe Agent Access

Use the least access needed for the current step.
Keep credentials in a secrets manager, never a prompt or worksheet.
Allowlist recipients, systems and destinations.
Prohibit payment, approval, submission and destructive actions by default.
Require a human decision for new access or authority.
Keep an audit trail of actions, exceptions and final states.
Make the live work visible enough to supervise.
Provide a simple pause, takeover and revocation path.
Test duplicates, broken inputs and unavailable access.
Review permissions after the first complete operating period.