The AI codes, cross-checks and drafts. What commits money is signed by a person.

No. The chart of accounts, the ledger and the financial statements stay where they are and the system integrates by API: it reads the account and supplier masters, proposes the coding and writes back the entry a person approved, with its reference. What the system adds is what does not live in the ERP today: the invoice that arrives by email and gets coded by hand, the reconciliation done in a spreadsheet, cost per barrel well by well, the contract nobody looks at until it renews itself. What gets integrated and what gets absorbed comes out of the assessment, and the plan is written before anything is touched.

No, and that is a rule written into the system, not good intentions. The AI compares the well’s cost per barrel against its own baseline, isolates the items that explain the gap, contrasts decline with peer wells and, if the margin falls into the marginal band, prepares the shut-in scenario with production forgone and cost no longer incurred. There it stops: the scenario waits. Shutting in, working over or leaving a well running is asset management’s call, and the decision is recorded with their name, the time and the reason.

Then the invoice is not coded: it goes to “needs review”. The accounting copilot codes from patterns — what that supplier billed before, against which contract, to which cost center — and with no history there is no pattern to support an account. The invoice arrives with candidate accounts, with the doubt written out and with a link to the original document, and the controller picks. From that decision on, the supplier sits in the master file with its pattern, so the next invoice arrives already coded with high confidence; what does not change is that it still needs an approval.

Yes. The field app works offline: the crew records the ticket, the dosing, equipment hours and photos on site, and everything stays on the device with the time and location it was captured at. When the device gets signal again it syncs, and the system resolves conflicts by showing both versions instead of overwriting one. The accounting coding of that ticket happens later, with the photo already uploaded, and it also waits for approval.

Permissions are per field and per role, at row level in the database. Finance sees the consolidated operator; a field superintendent sees their field and not group cash or the neighbouring field’s cost; the controller sees invoices and reconciliation across every scope but does not change an asset decision. The AI receives the fragment it needs for the task, not the whole database, and every access is recorded: who opened what and for what reason.

Data lives in your database, under your control, and the operator decides what is sent to the model and what is not. Most tasks need only a fragment — the text of an invoice, a well’s cost series, a clause of a contract — not the full history; what does get sent is written into the system’s AI usage policy, with its classification and its retention. Restricted information is marked as such and there are tasks that never leave the database. The details of deployment, region and the agreements with the model provider are defined in the assessment, against whatever each contract and each regulator requires.

It is defined in the assessment. The model has three parts: setup, a monthly fee and a variable cost per processed volume. The scope — how many fields come first, whether the ERP is integrated or absorbed, whether field operations come in with an offline app — comes from what we see in your operation. Book 30 minutes and we give you the range in writing.