Approving a payment is the moment a firm commits its money, and that commitment should always rest with a named person. An agent can prepare the payment run, match invoices, check bank details and flag anomalies. It must not be the approver, however small or routine the payment, because approval is where accountability attaches.
Why does approval have to belong to a person?
Payment approval does three things at once. It confirms the payment is owed, it confirms the destination is right, and it puts a name to the decision. The first two can be checked by an agent, often more thoroughly than a busy person would. The third cannot.
A named approver is someone who can be asked, afterwards, why they approved. They carry delegated authority from the firm, usually up to a limit. They can be held to account if the payment was wrong, and they know it, which is part of why they check. The concept is set out in named approver: what it means for AI agents.
An agent cannot carry delegated authority in that sense. It can be bounded, certified and recorded, but it cannot be held responsible. If an agent approves a fraudulent payment, the question "who approved this?" has no satisfactory answer. Firms that let agents approve payments have, in effect, removed the approval control and kept only the preparation.
Isn't depth 4 about moving money?
It is, and the distinction matters. Depth 4 covers actions that move money or are hard to undo, and an agent can earn it on strong evidence. But moving money is not the same as approving it.
At depth 4, an agent might execute a payment that a named person has already approved: releasing a batch to the bank, scheduling a payment for its due date, or submitting an approved transfer. The agent carries out a decision; it does not make it. Approval stays with the person, and the agent's execution is checked against that approval at the moment of action.
This separation keeps a person's decision in front of every payment while letting agents remove the manual steps around it.
What about small, routine payments?
This is where the temptation is greatest. A firm pays hundreds of small, recurring invoices: utilities, subscriptions, regular suppliers on fixed contracts. Approving each one individually feels wasteful, and an agent could easily check that each matches its contract and its history.
The answer is not to make the agent the approver. It is to let a person approve in bulk with good information. Options include:
- Batch approval: the agent prepares the batch with all checks done and exceptions flagged, and a named person approves the batch as a whole.
- Standing approval: a named person approves a recurring payment once, with defined limits on amount and timing, and the agent executes payments within those limits, holding any that fall outside.
- Threshold-based review: payments below a set amount from verified suppliers to verified accounts are approved in batch; those above are approved individually.
In each case, a person's decision covers every payment. The agent's role is to make that decision quicker and better informed.
What can the agent do around the approval?
| Stage | The agent | Depth | Stays with a person |
|---|---|---|---|
| Match invoice to purchase order and receipt | Matches and flags differences | 1 | Resolving differences |
| Check supplier and bank details against master data | Checks and flags changes | 1 | Any change to bank details |
| Prepare the payment run | Drafts the batch with checks | 2 | Approving the batch |
| Flag anomalies | Duplicate, unusual amount, new account, timing | 1 | Deciding whether to pay |
| Execute approved payments | Releases within the approval | 4, on evidence | The approval itself |
| Reverse a settled payment | Not permitted | Withheld at the platform floor on our own rail |
Anomaly flagging is where agents add most to payment control. They can check every payment against every rule, every time, which people cannot.
Why are external claims especially dangerous?
Because payment fraud usually arrives as a convincing message. An email that appears to come from a supplier says their bank details have changed. A message that appears to come from a director asks for an urgent transfer. An invoice arrives that looks right but is not.
All of these are external: they come from outside the firm's systems, and nobody inside has verified them. A core rule should hold: an external claim should never authorise a payment. An agent that reads such a message should treat it as unverified, flag it and hold any related payment. A person then verifies through a separate, trusted channel.
How do you make sure the approver is really a named person?
Keep a named approver roster listing who may approve which payments, up to what limits, with deputies for absence. Every approval in the record should name an individual from that roster, not a team mailbox or a shared login. When people leave or change roles, the roster changes, and the agent's checks use the current version.
The same discipline applies everywhere authority is delegated. The list of promises a support agent must never make follows the same logic: commitments of the firm's money need a person behind them. And some actions are prohibited outright for any AI system under certain laws, as set out in EU AI Act prohibited practices and what an AI agent must never do. Payment approval is not in that category; it is a design choice firms should make deliberately.
What should you do differently?
Check every payment flow in which an agent is involved and ask a single question: for each payment, can you name the person who approved it? If the answer is ever "the agent", change the design. Use batch or standing approvals to keep the workload manageable, and let agents do the checking that makes those approvals safe. This is the foundation of AI agents for finance: books you can audit.
Questions people ask
Can an agent reject a payment?
It can hold a payment and flag the reason, which stops it pending review. A final decision not to pay a valid invoice should be made by a person, since it affects the supplier relationship.
What if the named approver is unavailable?
Use a deputy from the roster. Never let the agent stand in, and never let urgency become a reason to bypass approval.
Does batch approval weaken the control?
Not if the batch arrives with every check done and every exception flagged separately. A person approving a well-prepared batch is exercising real judgement.