You set the spending limits. The systems your agents run on were never built to enforce them.

You approved a spending policy: agents may transact up to $5,000 per transaction, $25,000 per week. That policy lives in a document. The enforcement lives in prompts, API configurations, and service account permissions nobody reconciled against it.

Your payment systems were configured at deployment with thresholds that made sense for human operators. Agents inherit those permissions. Whether any technical control actually stops an agent above your declared limit is, in most organisations, an untested assumption.

Threshold rules that screen one transaction at a time do not screen intent. An agent can execute $4,900, then $4,800, then $4,700 in sequence: each transaction inside the declared limit, the combined exposure far outside anything anyone approved.

Approval gates implemented at the prompt level are not enforcement. Ask your team what percentage of the agent's autonomous financial actions depend on instructions rather than system controls. Zovent's testing typically finds this figure materially higher than finance teams expect.

When your auditor, insurer, or board asks what the maximum uncontrolled financial authority gap is, in dollars, the honest answer today is that nobody has measured it. The Authority Gap Test measures it.

A quantified Authority Exposure statement: the maximum financial authority your agents can exercise without a corresponding declared limit, expressed in dollars and legible to a board member or a cyber insurer from the same document.

A threshold enforcement map: every payment system your agents touch, showing whether each one technically enforces your declared limits or merely documents them.

Named and quantified capabilities that exceed the CFO's declared limits, with permission paths that have no identifiable authorising principal.

Action Replays for specific past transactions, independently reconstructing whether each one was actually authorised under your declared spending policy, not just technically permitted by the payment rail.

Authority Watch detecting when technical enforcement drifts: new payment systems connected, thresholds changed, or permissions expanded beyond the mandate you signed.