AI agents in procurement: ordering within limits

Key points

• The company's authority rules become binding for every agent as a mandate.
• A gateway checks every order against suppliers, product groups and amounts before execution.
• Suppliers can verify the mandate before they deliver.

Starting point

Many companies have authority rules: who may order up to which amount, which suppliers are approved, when a second signature is needed. For employees, this is governed by directives and systems. For agents, it is often missing: they receive access to the purchasing system and thereby effectively the account's rights.

Typical scenarios

• Catalog orders: an agent orders supplies from framework contracts as soon as stock falls below a threshold.
• Comparing offers: an agent obtains offers, compares them and prepares the order.
• Negotiation between agents: the buyer's agent negotiates quantity, price and date with the supplier's agent.
• Supplier management: an agent updates master data and checks suppliers' certificates and records.

What must be verified

For every order: whether it lies within the agent's mandate, meaning approved supplier, amount below the limit, permitted product group, and whether a decision exists. If an agent passes parts of the instruction on, for example to a negotiation agent, the delegation chain must narrow each level. Suppliers, in turn, want to know whether the agent may order for the company before they deliver.

Legal framework

The law of representation, in Switzerland Articles 32 et seq. of the Code of Obligations, in Germany Sections 164 et seq. BGB, requires a representative to act with authority to act. Internal limits of the authority rules apply to suppliers only if they are recognizable; a presented mandate makes them recognizable. Public procurement is additionally subject to procurement law, which agents must not circumvent.

Adoption

First transfer the authority rules into mandates per agent and purpose. Start with catalog orders from framework contracts, where supplier and price are fixed, and extend to offer comparisons and negotiations once decisions and receipts run reliably.

First steps in 30 days

1. Week 1: review the authority rules and define suppliers, product groups and amounts for each agent role.
2. Week 2: issue mandates and set up a gateway that checks every order before execution.
3. Week 3: start with catalog orders from framework contracts and write receipts referring to the decision.
4. Week 4: verify samples with KYA and inform suppliers about the evidence they can verify.

Frequently asked questions

May an AI agent order on behalf of a company?

If the company has authorized it to. The limits should be stated in a mandate that suppliers can verify, not only in internal settings.

How do I transfer the authority rules to agents?

By giving every agent a mandate with the limits of its role: suppliers, product groups, amounts, validity. A gateway checks every order against it before execution.

What happens with an order above the limit?

The decision service denies it or escalates to a person with sufficient authority. A signed decision records who approved it.

Can agents negotiate contracts with each other?

Technically yes. A contract becomes effective only if both agents act within their authority to act, however, and that should be checked before conclusion.

How do suppliers learn that an agent may order?

The agent presents its mandate with the order. Suppliers verify it with the company's public key, for example with KYA.

What applies to orders with several line items?

The limit set by the mandate decides, for example per order or per day. The gateway adds up the line items before it decides.

How do I prevent duplicate orders by several agents?

By routing orders through a shared gateway that knows open orders, and by recording every order exactly once.

May agents create new suppliers?

That is a high-risk action and should not be part of an ordering agent's mandate. A person approves new suppliers.

What applies to framework contracts in a foreign currency?

The mandate should contain limits in the contract currency. KYA does not convert currencies and reports a deviating currency with currency_mismatch.

General information, not legal advice. The statutes and the circumstances of each case are decisive.

Sources

1. Obligationenrecht (OR), Art. 32 ff.: https://www.fedlex.admin.ch/eli/cc/27/317_321_377/de#art_32
2. BGB, §§ 164 ff.: https://www.gesetze-im-internet.de/bgb/__164.html
3. NIST: Least Privilege: https://csrc.nist.gov/glossary/term/least_privilege