Breakthrough Preferences quick-fin

Multi-persona audit: 3 independent personas find disjoint control failures

breakthroughquick-finai-agents
Key Metric
Before
Single-perspective review of 244-tool MCP server
↓
After
CPA found 5+ critical control failures, CFO found governa...

Three auditors. Three completely different sets of findings. Almost zero overlap. That’s the result of running a 244-tool MCP server through a multi-persona audit : and it proves that single-perspective review has a structural blind spot.

Context

The QuickBooks Online MCP server for projects/quick-fin/_index exposed 244 tools spanning journal entries, payroll, tax filings, vendor payments, and financial reporting. A single reviewer : even a careful one : carries their own domain frame. An engineer auditing for data integrity misses financial control gaps. A CPA auditing for compliance misses pipeline architecture risks. The tool covered too much surface area for any one perspective to be complete.

The experiment asked: if three independent reviewers with different domain expertise audit the same system without coordinating, how much do their findings overlap?

What Changed

A 30-iteration audit ran three personas independently: CPA (financial controls and compliance), CFO (business governance and risk), and Data Engineer (pipeline integrity and data quality). Each persona applied domain-specific heuristics without seeing the others’ findings first.

The CPA flagged: audit trail immutability gaps, missing approval workflows for large transactions, no pre-submission validation, no idempotency protection, and batch control bypass vulnerabilities : 5 critical categories.

The CFO flagged: governance gaps in delegation authority and budget override controls.

The Data Engineer flagged: pipeline issues in reconciliation and data lineage gaps.

The overlap between the three sets of findings was minimal. Each persona surfaced a different slice of the same system’s risk surface.

Impact

Before: single-perspective review of a 244-tool MCP server. Unknown coverage of the risk surface. After: three disjoint finding sets with minimal overlap. The CPA alone found 5 critical control failures that the technical review would not have caught. Coverage of the risk surface tripled relative to any single-persona approach.

The minimal overlap is the key result. It means the personas are not duplicating each other’s work : they are genuinely seeing different things. Multi-perspective auditing is not additive, it is multiplicative.

Source