AI agents for finance · Part 2 of 14
What an AI agent can and can’t do in accounts payable
The AP jobs to give it, the ones to keep with people, where it goes wrong, and for each failure a check that doesn’t rely on the agent.
The short version
Give it the reading, coding, matching and chasing: it prepares bills well from known suppliers against an order. Keep new suppliers, changed bank details, approvals and the release of payments with people. It goes wrong in four places: a misread, a duplicate, a fraudster’s invoice, and instructions written into an invoice. Each has a check that compares the invoice with records the agent didn’t write, or limits what the agent may do.
What to give it, and what to keep
Sort the AP jobs by what a mistake costs. A wrong draft costs a correction. A wrong approval, payment or supplier record decides where money goes.
For the agent
Read the invoice
Spot checks on a sample, within your tool’s file limits.
Code the lines
Your chart of accounts and past invoices.
Match to the order
A price tolerance your accounting system applies.
Chase approvers
Your approval policy: it summarizes, a person decides.
A person decides where the money goes
Add a new supplier
Checks before the first payment (part 5).
Change bank details
A call to a number already on file (part 9).
Approve a payment
Your approval policy, applied by the system (part 8).
Release the payment run
A person at first, widened step by step on evidence (part 12).
Microsoft’s own page draws the line in the same place. It describes its agent’s intended use as “standard business invoices from known vendors”, says the account classifications and vendor matches it generates “can be inaccurate”, and doesn’t let the agent post an invoice.
Where it goes wrong
A commenter on Hacker News asked this year whether anyone was building an agent to review “is this legit to pay”, and named what it would need:
“it would work best only if you have suppliers enrolled in some kind of existing db, with a specific contracted format for invoices, and correlating with project numbers/cost codes.”
A commenter on Hacker News, 9 July 2026That holds for all four failures below. Each check compares the invoice with records the agent didn’t write, or limits what the agent can do.
1
It misreads or miscodes
How it happensA poor scan, an unusual layout or a new kind of purchase, and an amount or a GL account comes out wrong.
What catches itMatching to the order and the receipt within a tolerance, and a person’s look at a sample of coded lines.
Business Central’s matching warnings are “deterministic Business Central validations, not AI confidence”.
2
It pays the same invoice twice
How it happensThe invoice arrives by email and by post, or again as a reminder with a new reference.
What catches itA duplicate check on supplier, amount and date together, run before approval, and not on the invoice number alone.
3
It pays a fraudster
How it happensAn email that looks like the supplier’s gives new bank details, and the agent reads them as data.
What catches itBank details compared with the supplier record, and any change confirmed by a call to a number already on file.
Business email compromise drew 24,768 complaints to the FBI in 2025, with $3.05 billion reported lost.
4
It follows instructions in the invoice
How it happensSomeone writes instructions into an invoice or its email, and the agent treats them as yours.
What catches itPermissions that hold whatever it reads: an agent that prepares bills can’t approve, pay or change bank details.
Microsoft tested its agent “with malicious invoice content”.
The third is an old fraud with a new reader. The FBI describes business email compromise as a scam aimed at businesses that pay suppliers by wire, carried out by compromising email accounts. To an agent, new bank details in a convincing email are just more fields to read, so the comparison with the supplier record has to happen outside it.
The fourth has a name. OWASP’s list of risks for language models calls it indirect prompt injection: “Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files.” An invoice is such a file, written by a supplier or by someone posing as one. Support part 2 shows the same risk in a chat. In AP, the answer is the agent’s permissions: let the agent that reads invoices prepare bills, and nothing more.
Where to start
Start where the checks already exist: invoices from known suppliers, against a purchase order, with the goods recorded as received. Leave invoices without an order, such as one-off services, and every new supplier with people until your test on last quarter’s invoices (part 11) shows how the agent does on them.
Next in this series
Part 3: build or buy an AI agent for accounts payable. See all 14 parts.
Where Himmel fits
Himmel is a check of the fourth kind. Before the agent’s tool approves or pays, it asks Himmel, which checks the payment against your written approval policy and answers, whatever the invoice said.
Sources
- Microsoft Learn, “Payables Agent Frequently Asked Questions”, dated 2 October 2026, read on 25 October 2026.
- Hacker News, a comment on “GLM 5.2 is nearly as accurate as a human book keeper”, 9 July 2026, read on 25 October 2026.
- FBI Internet Crime Complaint Center, “2025 IC3 Annual Report”: complaints and losses by crime type (pages 7 and 8) and the definition of business email compromise (page 59), read on 25 October 2026.
- OWASP Gen AI Security Project, “LLM01:2025 Prompt Injection”, read on 25 October 2026.