We built an agent to stop manually re-keying invoices and expenses out of emails and deal notes into our own books. It reads the raw text, extracts the structured data, and posts the clean ones straight through — anything the guardrails flag waits for a human to click approve. We shipped it against Wave Financial in early August.
Four days later, we moved our own books off Wave entirely. New Wave accounts outside the US don't get the full feature set — ours didn't qualify for what we actually needed to run the business, not an agent problem, an account-region problem. We picked Invoice Ninja for the real books, and the agent had about a day to follow them over or stop working.
That's a real test of a claim we make to every client: identity, governance, and audit shouldn't be bolted to a specific vendor. If they're built right, swapping the platform underneath an agent should be a small, mechanical change — not a rebuild. Here's what actually happened when we had about a day to find out.
What we expected to have to rebuild
The instinctive fear with any "AI does your books" agent is that the model has quietly learned the shape of one specific platform, and moving to a new one means re-teaching all of it from scratch — then re-earning the confidence that the guardrails still catch what they're supposed to catch.
Wave modeled every transaction as one object: a single mutation with an anchor account and line items, whether money was coming in or going out. Invoice Ninja has no equivalent single object — money leaving the business is an Expense, money owed to the business is an Invoice, with different required fields entirely. If the agent had been built around Wave's shape everywhere, this migration meant touching almost every file.
What actually had to change
One thing: the extraction step now emits a type field — expense or invoice — and one dispatcher function routes to the matching Invoice Ninja call instead of the old single Wave mutation. Vendors and clients are still matched or created by name on the new platform's side, same as before; the model was never trusted to invent an account ID under either system, so that part didn't move at all.
Everything that actually decides whether an action is safe to take unattended didn't move either. The guardrails still independently re-check every extracted transaction — an amount threshold, a GST/ABN sanity check, an FX-drift check, an allow-list of expense categories — as the same server-side code, blind to which platform the money eventually lands in. They were never written to trust the model's own opinion of whether something needed approval, so there was nothing platform-specific in them to unlearn.
The approval queue is identical infrastructure either way: a flat-file record for anything flagged, waiting for a human to click approve or reject. And every transaction still runs on a scoped API credential rather than a shared login, so an audit of "what did this agent do and under what authority" reads the same regardless of which platform answers it.
Why the swap stayed small
That's the five principles doing their actual job, not just sitting in a diagram. Identity — a scoped credential per integration, not a shared one needing re-issuing everywhere. Governance — guardrails that live in our code, not the vendor's. Audit — a record format we control, not one we're borrowing from whichever platform happens to be underneath. All three sat one layer above the platform the whole time. The platform was a client the agent calls, not something the governance was built into.
This was a small agent with a narrow, well-scoped job, and that's exactly why four days was enough. A larger deployment with governance logic written inline inside a vendor's SDK calls, instead of as its own independent layer, would not have had this easy a week. Decoupling governance from the platform has to be a decision made on day one — not a refactor you get to do later, once the migration is already forced on you.
The question to sit with
If the platform your AI agent talks to today disappeared with a day's notice, how much of the agent would you actually have to rebuild — the extraction, the guardrails, the approval logic — or just the one client at the bottom that happens to speak to it? If the honest answer is "most of it," that's not a platform risk. It's a sign the governance was never actually separate from the integration in the first place.