Answers · agent payments
How do I keep segregation of duties when an AI agent pays bills?
Last updated
TL;DR: Give the agent one job in accounts payable, usually the clerk's: read invoices, draft bills, match them to purchase orders or receipts and queue them. Approving bills, releasing payments and changing a vendor's bank details stay with people who aren't the agent, and the person who controls the agent shouldn't be the only approver of what it drafts. Enforce this with the agent's own user or app connection and the accounting system's roles and approval workflows, not with instructions in its prompt. In QuickBooks Online, Bill Pay roles separate the bill clerk, bill approver and bill payer, and QuickBooks Online Advanced or Bill Pay Elite workflows can require approval of bills and of payment releases. Intuit's help says that once a transaction from a third-party app is sent for approval, a later change made in the app doesn't start a new approval, so check the amount, payee and bank account again right before payment goes out.
What should I check, step by step?
1. Write down each payables step (receive invoice, enter bill, approve bill, add or change vendor, release payment, reconcile) and who or what does it. The agent should hold at most one of approve, pay and change vendor bank details.
- Give the agent its own user or app connection with the narrowest role for its step. In QuickBooks Bill Pay roles, a bill clerk adds bills, marks them paid and can add and edit vendors but can't approve or pay; a bill approver can only approve; a bill payer pays bills and can edit vendor details.
- Turn on approvals: a bill approval workflow by amount, vendor or location (up to 7 approvers and up to 5 sequential layers) and a payment release approval workflow, where only admins can be approvers. Requests not reviewed in 30 days are denied automatically.
- Keep vendor bank-detail changes away from the agent where you can. Both the clerk and payer roles can edit vendors, so if the agent is a clerk, review every vendor change it makes and confirm new or changed bank details by calling the vendor on a number you already had.
- Recheck at release: the payee, bank account and amount being paid should equal what was approved. If anything changed after approval, approve again.
- If the agent works through a person's login rather than an app connection, use a non-admin login. Intuit's help describes multi-condition approvals as applying when a non-admin creates the transaction.
- Add limits that hold even if an approval is wrong: per-payment and daily caps, an allow-list of vendors, and your bank's payment limits or dual approval.
- Review monthly: bills the agent created, who approved each, vendor changes, and any payment that went out without an approval.
Why an agent needs segregation of duties too
Segregation of duties means no single actor can both create and approve a payment, or change where money goes and then pay it. An agent that can draft, approve and release payments is that single actor, and it can be misled: a fake invoice or a 'we've changed banks' email it reads is input it may act on.
- That email is the core of business email compromise. The FBI's IC3 counted 305,033 incidents and $55.5 billion in exposed losses worldwide from October 2013 to December 2023, and recommends using secondary channels or two-factor authentication to verify requests to change account information.
What QuickBooks Online gives you, and the gaps
Bill Pay Elite comes with fixed bill roles; QuickBooks Online Advanced can also customize roles. Intuit says that downgrading from Bill Pay Elite without Advanced removes the roles and approval workflows and rejects payments pending approval.
- Intuit's global help says transactions created by third-party apps, imports, receipt capture or spreadsheet sync go straight into Pending approval, and approval conditions can use the transaction's source (an app, an import or QuickBooks itself). The same page says a change made in the app after the transaction is sent for approval doesn't start a new approval.
- Bill approval and payment release are separate workflows. Approving a bill doesn't by itself control when or to which account it's paid, so turn on both if the agent can schedule payments.
An approval the agent can't fake
An approval the agent records for itself, or reads from a chat message, isn't separation. The approver should decide in a system where the agent can't act as them, and the record should name the exact payee, bank account reference, amount and currency.
- Hash those details when they're approved and check the hash again right before release, so a changed amount or account fails instead of riding on an earlier yes.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Before releasing this bill payment, ask the owner to approve the exact vendor, bill, amount and bank account reference, and wait for the decision.”
{
"tool": "request_human_approval",
"arguments": {
"summary": "Pay bill BILL-2219 from vendor V-1042: 1,840.00 USD to the bank account ending 6789.",
"action": {
"type": "pay_bill",
"vendor_ref": "V-1042",
"bill_ref": "BILL-2219",
"amount_minor": 184000,
"currency": "USD",
"bank_account_last4": "6789"
},
"expires_in_minutes": 1440
}
}- Needs an API key. Only the account that made the request can decide it, with its owner account key (decide_human_approval). Delegated agent keys are refused, so the agent can ask but can't approve itself. The one-time token works once and a decision is final.
- verify_human_approval (free, no key) checks a decision receipt and, given the action details, whether they hash to what was approved, so the payment step can confirm right before release that nothing changed.
- set_spend_policy (owner key) sets per-payment and daily caps for an agent credential, and authorize_spend returns a signed allow or deny before each payment. Both record decisions only and never move money.
Rightshold doesn't connect to QuickBooks, Xero or your bank, and doesn't hold, send or block payments. It records approval requests and the owner's signed decisions. A decision shows that the owner account key decided, not which person used it, and Rightshold can't stop an agent that pays without asking. Enforce roles and approvals in your accounting system and bank. Not legal, tax or accounting advice.
What are the sources?
- QuickBooks: Set up and use bill approval and payment release workflows (Bill Pay roles)
- QuickBooks: Use workflows to automate business processes (US)
- QuickBooks: Use workflows (global; approvals for third-party and imported transactions)
- FBI IC3: Business Email Compromise: The $55 Billion Scam (I-091124-PSA, September 11, 2024)
Related
- How can a CPA audit what an AI agent did in the books?
- How to require human approval before an AI agent spends money
- How to show a human the actual change before approving an AI agent action
- How to stop an AI agent from paying twice when it retries
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'