Reviewing and approving expense reports with AI

How the bot works

Eight steps. The first six cost almost nothing to run; the model is only asked the questions that actually need judgment.

1. It picks up the report. A new report in your expense tool, receipts forwarded to a mailbox, or a scheduled batch — whichever trigger fits the way your team already works.

2. It reads the receipts. Every image or PDF becomes fields: merchant, date, currency, subtotal, tax, tip, total, payment method, card last four, line items, and whether it's itemized. Each field carries a confidence value and a pointer back to where on the receipt it came from.

3. It matches three records. Receipt, expense line and card transaction — matched on amount, date window, merchant and last four. A line with no receipt, or a receipt that doesn't match the charge, is reported as exactly that. Nothing is guessed.

4. It checks your policy clause by clause. Your policy document is compiled once into a numbered rule set that you review and sign off. Every finding cites the clause id and quotes the clause — never a bare "policy violation". If no rule covers the situation, that's a policy gap, and it goes to a person. The bot does not invent a rule.

5. It runs the checks people skim past. Duplicate submissions across every report and every submitter. The same charge split into pieces that each sit under a threshold. Weekend, holiday and out-of-travel-window dates. Round numbers. Mileage that doesn't match the route. Per-diem overlapping a meal claimed separately. A merchant category that contradicts the stated purpose. A vendor nobody has used before.

6. It scores risk and confidence separately. Risk comes from the findings — how many, how severe, how much money, and whether it's a pattern for that submitter. Confidence comes from how cleanly the receipt read and matched. A blurry receipt can't produce a confident approval; it produces an escalation.

7. It decides what happens next — inside your rules. Low-risk, fully evidenced, under your ceiling: auto-approve, if you turned that on. Anything else goes to the approver with a one-paragraph summary and the cited evidence, or back to the submitter with a specific fix request — "the March 14 dinner needs an itemized receipt showing attendees; section 4.2 requires it over $75" — rather than a generic rejection.

8. It writes the audit row. One immutable record per decision: the rule, the evidence, the risk score, the model and prompt version, the decision, the approver, the timestamps.

What you configure

It can be configured to run in any business, and this is what that actually means — the list of things that are yours, not ours.

Your policy

The document you actually issue, compiled into a numbered rule set you review and sign off, with your per-diem tables, mileage rate, class-of-travel rules, the categories that need a stated reason, and the list of things that are never reimbursable.

Your thresholds

Dollar ceilings per line, per report, per submitter per period, per tier. Amount tolerances and date windows for matching.

Your risk tiers

How many, what lands in each, and what each one triggers.

Your approvers

Routing by amount, department, cost center, grade or named delegate — plus escalation and out-of-office fallbacks.

Auto-approve

Off by default. On per tier, per category, per department, under a ceiling — entirely your call, and reversible with one flag.

Your channels

Email, Slack, Microsoft Teams, or straight back into your expense tool's own approval queue.

Your systems

Which one is the system of record, and whether we read it through an API or a scheduled export.

The words it uses

Summary tone and length, and the versioned prompts behind them — yours to read, yours to tune.

Transparent, and configurable by you

The dark band below is what the system will not do. This is what you can see and change — and it is how we build everything, not something invented for this page.

You see what it did, and why

Every finding cites the clause id and quotes the clause — never a bare "policy violation". The summary that reaches an approver carries the evidence it was drawn from, so the reasoning can be checked against your own document rather than taken on trust.

Versioned prompts you can tune yourself

The prompts behind the decisions are yours to read and yours to tune. A change is a reviewable diff, replayed against your historic reports before it goes live, and rolled back the same way.

A human in the loop wherever judgment actually matters

Automation handles the clear cases. Anything outside your rules goes to a person, with a one-paragraph summary and the evidence attached. That boundary is a property of the system, not a promise about how carefully we'll use it.

Every run logged, along with what it cost

One immutable record per decision: the rule, the evidence, the risk score, the model and prompt version, the decision, the approver, the timestamps — plus token usage and cost for that decision.

It can be configured to run in any business. The rules and the thresholds are yours: your policy, your dollar thresholds, your approvers, your systems. The expense-report wiring on this page is one configuration of it, not the limit of it.

Works with your tools

This runs on top of the stack you already pay for. We're not replacing your expense tool.

• QuickBooks Online
• Xero
• Expensify
• SAP Concur
• NetSuite
• Zoho Expense
• Ramp or Brex card exports
• Bank statement exports
• Email, Slack or Microsoft Teams

Works well for

• Construction companies — Crews buy materials and fuel across several jobs, and every receipt has to land on the right job.
• Nonprofits — Grant-funded spend has to be coded and substantiated, and an unreceipted line is an audit finding.
• Field service companies — Technicians buy parts on the road, and the card charge and the receipt arrive days apart.
• Trucking fleets — Fuel, scales and lumper fees come in as paper, and the per-trip rules are not the office's rules.
• Schools and districts — Reimbursements pass through approvers who have never read the policy they are approving against.

How a rollout works

Nothing goes live on day one. Shadow mode comes first, and it is where your own numbers come from.

1. 01Discovery

   The quote call, then a working session. We read the policy you actually issue, a few months of real reports and what your approvers decided, the approval chain, and what access your systems allow. You get the compiled rule set, the tier design and a written scope.

2. 02Shadow mode

   The bot runs over historic reports only. Nothing is routed. Nothing is approved. Nobody's day changes. It produces a recommendation per report and we compare it, line by line, against what your approvers actually decided. Every disagreement is either a rule to fix or a miss worth knowing about — and this is where your own accuracy numbers come from, on your own reports.

3. 03Assisted mode

   Live reports. The bot reviews, summarizes and attaches the evidence; your approvers still click every approve. The queue gets faster to work. The control doesn't change.

4. 04Limited auto-approve

   Optional. Lowest-risk tier only, under a dollar ceiling, with a sampled human review, every hard stop in force, and the kill switch. Plenty of teams stop at step 03, and that's a good place to stop.

What we don't claim

• No numbers we haven't earned. No percentage of time saved, no fraud-catch rate, no accuracy figure. We haven't run this on your reports. Shadow mode is where those numbers come from, and they'll be yours.
• No customer claims on this page. No names, no case studies, no logos.
• It isn't an audit opinion or a tax position, and it doesn't replace your controls, your accountant or your approvers.
• It doesn't replace your expense tool. It works on top of it.
• Fully autonomous approval isn't on offer. The design assumes a person owns the judgment calls. That's deliberate, and it's why the boundary is written down.

Questions people ask

Can AI approve expense reports?

Yes - within rules you set, and not unconditionally. The honest version is that an AI agent can review every report, check it against your policy, flag what is wrong with cited evidence, and auto-approve the narrow band of claims that are low-risk, fully evidenced and under a dollar ceiling you chose. Everything else goes to a person. We build it with auto-approve switched off, and you turn it on for the lowest-risk tier only when you have seen it work on your own reports.

Will it approve expenses on its own, without anyone looking?

Only if you explicitly turn that on, only for the lowest-risk tier, and only under your dollar ceiling - and even then a sampled share still goes to a human. A missing receipt, a new vendor, changed payment details, a policy gap, a low-confidence read, a duplicate or a split transaction can never be auto-approved in any configuration. Many teams run it permanently in assisted mode, where it reviews and summarizes and a person clicks every approve.

How does it know our expense policy?

We compile the policy you actually issue into a numbered, machine-checkable rule set - with your per-diem tables, mileage rate, category rules and non-reimbursable list - and you review and sign off on that rule set before it goes live. Every finding then cites the clause id and quotes the clause, so you can check the bot's reasoning against your own document. When the policy changes, the rule set is versioned alongside it.

What happens when a receipt is missing or unreadable?

It is never auto-approved. The line is reported as receipt-missing or low-confidence, and the report either goes to the approver with that stated plainly or back to the submitter with a specific request: which expense, which date, which document, and the clause that requires it. A blurry receipt is an escalation, not a guess.

Can it catch duplicates and split transactions?

Yes, and that is one of the cheapest, most reliable parts. Duplicate detection runs across every report and every submitter, not just the one in front of it, so the same receipt submitted twice a month apart is caught. Split transactions - one charge broken into pieces that each sit under a threshold - are detected by looking at merchant, date proximity and the combined amount against the threshold it would have breached. Both are deterministic checks: no model judgment, no false confidence.

Does it work with QuickBooks, Xero, Expensify or Concur?

Yes - by API or by scheduled export, alongside NetSuite, Zoho Expense and card-program exports from Ramp, Brex or your bank. If your system of record is not one of those, the question is only whether it offers an API or a scheduled export; most do, and an export is all shadow mode needs. Naming a system means we can read it, not that we are partnered with it.

Is there an audit trail for every decision?

Yes, and it is designed for the person who has to test the control. One immutable row per decision records the claim and line ids, every rule evaluated with its version, the findings with cited clauses, the evidence references, the risk score and tier, the decision and the written reason for it, the model and prompt version that produced it, the approver and their action, and UTC timestamps. The intent is that someone who was not there can reconstruct any single decision from that one row.

What stops someone hiding instructions in a receipt to trick it?

Receipt text, memo fields and merchant names are treated as data and never as instructions. Every model call runs as structured output against a fixed schema, untrusted text is kept out of the instruction block, and anything that reads like an instruction is quarantined, flagged for a human and logged. A receipt cannot raise its own approval ceiling. Separately, the deterministic checks and dollar ceilings sit outside the model entirely, so there is nothing there to talk around.

How long does it take to get running?

The first milestone is shadow mode, and it needs three things: your policy document, read access or a scheduled export from your expense system, and a few months of historic reports with the decisions your approvers made. We will not quote you a timeline before we know which systems are involved and what access they allow - you get a real one in your quote, once Ozzie's call has gathered the details.