AI agent pays invoices: automating safely

Key points

• An agent pays invoices only within a mandate with amount, suppliers and validity.
• New or changed bank details are never accepted automatically but escalated.
• Every payment becomes independently verifiable with mandate, decision, receipt and timestamp.

Starting point

A company receives hundreds of invoices a month. An agent reads them in, matches them against orders and delivery notes and prepares payment. Without limits, it could pay any invoice, including a forged one that an attacker slips in with slightly altered bank details.

The goal is to automate the routine and hand exceptions safely to people, with evidence for every payment.

Flow with evidence

1. Mandate: the agent receives a mandate for payments to known suppliers up to CHF 5,000 per invoice, valid for one quarter.
2. Matching: the agent checks invoice, order and delivery and detects deviations.
3. Decision: a decision service checks amount, payee and bank details against the mandate and signs a decision.
4. Approval: above CHF 5,000 or with new bank details, a person decides.
5. Payment and receipt: the bank executes, and a receipt records amount, payee and a reference to the decision.

Risks and countermeasures

• Changed bank details: the most common fraud case. Never accept new or changed details automatically; escalate them.
• Duplicate payment: match invoice numbers and amounts, and record every payment exactly once.
• Injected instructions: text in an invoice must never lead the agent to payments outside the mandate (prompt injection).
• Limits too wide: mandates per purpose and with short validity instead of blanket payment rights.

What KYA verifies

For every payment, an evidence pack of mandate, decision, receipt and timestamp can be formed. KYA checks whether the mandate was valid and not revoked, whether amount and payee were within scope and whether the payment matched the decision. Auditors can recompute every payment independently this way.

Adoption

Start with one group of suppliers and a low threshold, verify the receipts by sampling with KYA and raise the threshold only once the flow runs stably. The checklist for AI agents summarizes the remaining steps.

Roles and responsibilities

• Finance management: sets limits, approved suppliers and thresholds and issues the mandate.
• Operations: runs the agent and the decision service, maintains keys and the status list.
• Accounts payable: decides on escalated cases and new bank details.
• Audit: verifies samples with KYA and reports deviations.

Operating metrics

Meaningful metrics are the share of invoices paid automatically, the number of escalated cases and their reasons, denied decisions by reason and the time to revoke a mandate in an emergency. If the share of denied decisions rises suddenly, this can indicate manipulated invoices or a misconfigured agent.

How the certificate looks

For a payment of CHF 480 to a known supplier, the agent presents an evidence pack of mandate, decision, receipt and timestamp. The certificate shows all ten checks: format recognized, signatures valid, issuer trusted, agent bound to the mandate, mandate valid, amount and payee within scope, no delegation, not revoked, receipt matching the decision, timestamp anchored. The verdict is valid, the level KYA-A4.

Had the agent paid CHF 5,480, the scope check reports the code amount_exceeds_limit, and the verdict is invalid. If the status list is missing, revocation stays unchecked, and the verdict is indeterminate.

Frequently asked questions

May an AI agent pay invoices on its own?

Technically yes, within internal rules and the contracts with the bank. What matters is that every payment lies within a mandate and is traceably recorded.

How do I protect myself against forged invoices?

By never accepting new or changed bank details automatically but escalating them to a person, and by matching every payment against order and delivery.

Which threshold makes sense?

That depends on the risk. Many start low and raise the threshold once the receipts show the flow is stable.

What do auditors need?

For every payment: mandate, decision, receipt and ideally a timestamp, as an evidence pack that can be verified independently.

What about early-payment discounts and deadlines?

The agent can optimize payment dates as long as amount, payee and bank details lie within the mandate. Deadlines and discounts do not change the check before payment.

How do I react if the agent is compromised?

Revoke its mandate immediately through the status list. The decision service then denies every further payment, even if the agent still has access to systems.

How many invoices can an agent pay per day?

Technically very many. The mandate should set limits, for example a total per day, so a mistake or an attack does not trigger large amounts unnoticed.

Sources

1. Richtlinie (EU) 2015/2366 (PSD2): https://eur-lex.europa.eu/eli/dir/2015/2366/oj
2. NIST: Least Privilege: https://csrc.nist.gov/glossary/term/least_privilege