Connect the agent through its own service account and grant the tool's scopes one at a time. Reading, capture, coding and matching can run at depth 2 or 3. Approving invoices, releasing holds above a limit and preparing payment runs are held for people. Editing supplier bank details and releasing payments are refused. Test revocation before go-live.
What does the connection involve, and who owns it?
An accounts payable automation tool sits between your inbox and your ledger. It captures invoices, extracts their data, matches them to orders and receipts, routes them for approval and prepares payments. Most such tools expose these functions through an integration interface with separate scopes. Each scope is a capability the agent might be given, and each carries a different risk. The function itself is explained in what is accounts payable.
The accounts payable lead owns the tool and decides which scopes the agent receives. The financial controller approves anything that touches approval or payment. IT or the tool administrator creates the service account and holds the credentials. The wider finance position is in AI agents for finance: books you can audit.
Which scopes should you grant, and at what depth?
| Capability in the AP tool | Depth | Bound | Stays with a person |
|---|---|---|---|
| Read invoices, status, history | 1 | None | Nothing |
| Capture invoices from documents | 3 | Intake channels only | Rejected captures |
| Correct extracted fields | 3 | Not amount, supplier or bank details | Those fields |
| Code lines to accounts and cost centres | 3 | Order-based or under value limit | Held lines |
| Match to order and receipt | 3 | Within matching tolerance | Exceptions |
| Route for approval | 3 | To the approver in the matrix | Changing the matrix |
| Approve an invoice | None | Refused by your limits | Approvers |
| Place a hold | 3 | Duplicate or mismatch reasons | Nothing |
| Release a hold | 2, held | Always held | Accounts payable lead |
| Propose a payment run | 2 | Draft only | Treasury approval |
| Release a payment | None | Refused by your limits | Payment authorisers |
| Edit supplier master or bank details | None | Refused by your limits | Supplier master team |
| Delete an invoice | None | Refused by your limits | Accounts payable lead |
The pattern is that the agent prepares and people decide. Placing a hold is allowed because it stops money; releasing one is held because it lets money go. Bank details are refused outright because changing them is the most common route to payment fraud. Payments themselves are depth 4 and, for most teams, stay with named authorisers.
How do you set it up, step by step?
- Person, tool administrator: creates a dedicated service account. Not a copy of a staff user. Its name makes clear it is an agent.
- Person, accounts payable lead: grants scopes to match the table, and nothing else. If the tool's scopes are coarser than the table, use the narrowest available and rely on the platform to refuse the rest.
- Person: sets the agent's own limits on the platform to match: value limits for coding, matching tolerance, hold reasons.
- Agent, depth 1: runs in read-only mode first. It reads live invoices and proposes what it would do, without writing. A person compares its proposals with what the team actually did.
- Attest: replays past invoices and scores capture, coding and matching against the floor.
- Person: switches on each write scope as the agent's certificate reaches the depth it needs.
- Person: tests revocation before go-live, at each level below.
What is held, and how are held actions worked?
Held actions appear in a queue in the AP tool or on the platform, each with the draft, the evidence and the bound that held it. Common held items: hold releases, coding on lines that trip a judgement trigger, matches outside tolerance, and the proposed payment run.
Payment timing is worth a word. An agent asked to optimise cash might learn to propose paying every invoice on its last possible day. That improves days payable outstanding but can breach supplier terms and damage relationships. Payment timing policy belongs to treasury, and the run proposal is held for them.
How do you revoke access?
At four levels. One scope: remove it from the service account and the capability stops, while others continue. One capability on the platform: withdraw it and the agent drafts instead. The whole agent: disable the service account or revoke its credentials. And automatically: a certification run that clears no depth drops the agent to depth 1 the same day, and certificates lapse after 90 days without renewal.
Rotate the service account's credentials on the same schedule as other integrations, and store them where only the administrator can reach them.
What does the audit trail record?
Two records, which should agree. The AP tool keeps its own log of every change made by the service account. Pryme files a verdict for every action the agent attempted, allowed, held or refused, with the bounds checked and the one that decided. The tool's log shows what changed; the verdict shows why it was allowed. When they disagree, for example a change in the tool with no matching verdict, someone has used the service account outside the agent. Investigate at once.
Where does it usually go wrong?
Scopes are coarser than they look. "Write invoices" in one tool may include approval. Read the tool's documentation for each scope and test what the account can actually do.
The service account is shared. A staff member uses its credentials for a bulk fix. Now the record attributes their changes to the agent.
Multi-entity setups. Group companies often run one AP tool across many entities. Grant per entity, not globally; consolidation questions sit elsewhere, as discussed in can an AI agent consolidate group accounts.
Other connections overlap. If the agent is also connected to your expense tool, the same supplier or payment may be visible in both. Keep grants aligned; see connecting an AI agent to your expense management tool and connecting it to your BI tool for the parallel setups.
Questions people ask
Can the agent approve small invoices?
Approval is a budget holder's confirmation that the spend was wanted. You can certify the agent to approve within narrow bounds, but most teams keep approval with people and let the agent make it fast.
Should the agent read supplier bank details?
It may read them to check for duplicates and recent changes. Writing them stays refused.
What if the AP tool has its own built-in automation?
Map what the tool does automatically before adding an agent. Two automations acting on the same invoice produce confusing records and, sometimes, double actions.