AI recommendations are not approvals: three controls in a synthetic payment-investigation demo

I built FinSentry AI, an independent side project exploring AI-assisted payment investigations. I'm the developer; the walkthrough uses recorded synthetic sandbox data. The key distinction is between producing an explanation and having authority to change a case. Finishing an agent run should not silently become permission to act. Documented stack: React/TypeScript, FastAPI, LangGraph and PostgreSQL. Domain services own case state and approvals; the agent runtime coordinates advisory investigation steps, and the API enforces authorization. Three concrete controls illustrated in the walkthrough: Missing evidence means abstention. When required screening input is unavailable, the advisory path abstains. Missing evidence should not become clearance just because a model can produce a plausible explanation. A request is not an approval. The maker/checker workflow includes a self-approval restriction. The requester and the person authorized to approve must remain distinguishable; a "human in the loop" label alone does not establish that separation. Approve an exact action, not a vague outcome. The illustrated approval maintains an existing hold. It does not release funds, and the audit trail leaves the case under investigation. "Approved" is incomplete unless the reader can see what changed and what did not. For a production version, I would separately test missing mandatory inputs, same-user approval attempts, evidence changing after a request, and duplicate execution. These are proposed acceptance checks, not passing results claimed by the recording. One boundary I would test next is stale approval: if evidence changes between request and review, should any change invalidate the request, or only changes relevant to that action? Recorded walkthrough (4:20, MP4 download) Architecture and demo limitations The public package contains documentation and media, not application source. This recording is not a paid client deployment or evidence of regulatory certification, production readiness, or a fully passing integration/test suite. Disclosure: AI assistance was used to draft this post.