A procurement team asks an AI Agent to organize price comparison data, verify payment terms, and create a payment request. When a manager opens the system to approve it, a difficult question often arises: if all the supporting information has already been prepared, can the final confirmation and payment submission also be entrusted to the AI Agent? If the only possible answer is “yes” or “no,” the permissions are too broadly defined, and it will be difficult to determine who is responsible when something goes wrong.
According to TechOrange, JPMorgan Chase, Charles Schwab, Citigroup, and Bank of America have restricted external AI Agents from operating customer accounts. Their approaches vary, but they generally separate information retrieval from funds transfers. Bank of America goes further, arguing that a person should participate in the authorization process before funds are transferred. The lesson for enterprises is straightforward: once an AI Agent is involved with funds, the organization must first distinguish the permissions required for read-only access, draft creation, approval, and execution, and then decide how far the process should be automated.
Break Payments into Five Steps Before Assigning Permissions
Enterprises do not need to begin by debating whether an AI Agent should be allowed to make payments. Instead, they can map out their existing process and break down each action. A vendor payment process, for example, can be divided into five steps: retrieval, recommendation, payment draft creation, approval, and execution. Retrieval involves accessing purchase orders, acceptance records, and accounts payable data. Recommendation involves comparing payment terms, due dates, and discounts. Draft creation involves completing the payee, account number, amount, and payment date fields without submitting the payment. An authorized person then approves the request. Only at the execution stage do funds leave the company’s account.
These five steps should not share the same set of permissions. If the AI Agent is responsible only for the first three steps, it does not need approval or funds-transfer permissions. Likewise, approvers should not review only the summary simply because the AI Agent has already organized the information; they must still verify the recipient’s account, payment amount, and supporting documents. If the same identity can create payment information, approve it, and execute the transaction, the intended segregation of duties becomes meaningless, making it difficult to determine where an error occurred.
A team can start by selecting one payment process, mapping these five steps, and clearly documenting the following for each step: which data can be accessed, which fields can be added, who has approval authority, and which system ultimately submits the payment. If these four points are not yet clear, execution permissions should not be granted to the AI Agent.
When Must the Process Stop and Wait for Human Confirmation?
Human approval should not be limited to the final step of the process. The workflow should stop and require a designated person to review the original documents and discrepancies whenever the amount exceeds the department’s authorization limit, the recipient’s account does not match the master data, invoice or acceptance documentation is incomplete, the payee is new, or the AI Agent finds conflicting information. The approval screen must also present the information the approver needs to assess the request, rather than displaying only an “Approve” button.
The team should also define in advance how to handle three scenarios: which step follows approval, who is responsible for completing missing information after a request is returned, and whether the payment should be canceled if no one responds before the deadline. Otherwise, even with human approval built into the workflow, urgent payments may still be handled through email, messaging software, or manual data entry, creating yet another unmanaged payment path.
EgentWrX can connect multiple tasks into a workflow and require human approval before the handoff. After the AI Agent completes the initial work, the workflow pauses until a person reviews and authorizes it to proceed. During the first phase, the AI Agent should only be allowed to retrieve essential information in read-only mode through the company’s internal network. External connections should be disabled by default, with access granted only to necessary domains that have passed review. Once the team has confirmed that approval criteria, return procedures, and incident notifications all operate according to the defined rules, it can evaluate whether to grant additional permissions for subsequent steps.
Can You Determine Who Did What After an Error Occurs?
Payment process records should contain more than just “successful” or “failed.” Enterprises need to retain records of which data the AI Agent accessed, which version of the payment draft it generated, which documents informed its recommendations, who approved the request and when, and which transaction the system ultimately executed. If information was missing, the organization must also preserve the content that the AI Agent actually saw at the time. Otherwise, it will only be able to review the payment outcome later, without determining whether the issue originated in the source data, decision rules, human approval, or system integration.
The responsibilities of each department should also be defined when planning how records will be maintained. Business units are responsible for confirming payment terms and exception rules. Finance manages approval and execution permissions. IT and information security oversee identity verification, connection scope, and record retention, while the audit team conducts regular spot checks. During procurement and contract negotiations, enterprises should also determine the extent of the tool provider’s responsibilities. At a minimum, they should clarify which records can be provided when an error occurs, how the provider will assist with an investigation, and who can access the relevant data.
EgentWrX’s audit logs can record the actions performed by an AI Agent and use a hash chain to verify whether the records have been altered. Administrators can also export data from the export center for review by information security or audit teams. Before allowing the workflow to process real funds, the implementation team can run test payments through normal, returned, and exception scenarios to confirm that the operator, approver, and data used at each step can all be identified.
FAQ
Can an AI Agent be given online banking usernames and passwords directly?
Giving personal usernames and passwords to an AI Agent is not recommended. Enterprises should instead use controlled authentication and system connections, with separate permissions for retrieval, draft creation, approval, and execution. During the first phase, only read-only access to essential data should be enabled, preventing the AI Agent from using an employee’s account to execute payments directly.
Can human approval be removed for small payments?
Removing human approval solely because the payment amount is small is not recommended. Teams can apply different review methods based on the amount, payee, completeness of the information, and any exceptions. However, they must still assign a responsible person and retain mechanisms for spot checks and immediately stopping the workflow. Before going live, the rules should also be validated using lower-risk test payments.
What information should the human approval screen display?
At a minimum, the approval screen should show the payee, account number, amount, reason for payment, original supporting documents, and exception alerts. If the AI Agent has modified any data, the screen should also display the differences before and after the changes, along with the basis for those changes. This allows the manager to review each item instead of approving the request based only on a summary.
Who should be responsible when a payment error occurs?
Enterprises should assign responsibilities before the system goes live rather than waiting until an error occurs. Business units are responsible for verifying rules and supporting documents, finance personnel are responsible for approvals, IT and information security are responsible for managing identities and connections, and the tool provider must supply the necessary records and investigative support in accordance with the contract. Every action performed by each role must be recorded.
References
- U.S. Banks and Brokerages Block AI Agents from Moving Customer Funds: How Are JPMorgan Chase, Charles Schwab, and Citigroup Drawing the Line? — TechOrange summarizes the restrictions imposed by major U.S. banks on external AI Agents regarding information retrieval, account operations, and funds transfers.
