Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Which AI Agents Ask Before Releasing a Payment Run?
None of the consumer agents reviewed asks before releasing a payment run: each reads the real invoice and bank screens, and its prompt covers one action, not the batch. A run of fifty invoices needs a named approver on the run, a record of what the model saw, and values replaced before any model reads them.
A finance team closes the month with fifty invoices, one pay date and a bank portal that will accept a batch. The agent in the browser can open each vendor record, match the bill and prepare the payment, and at the end a dialog asks the person at the keyboard to confirm. That dialog is the moment the team remembers, but the page carrying the vendor's bank details was rendered to the model before the question appeared. The question covers the action in front of it, not the run behind it, and the fields the model read are already in its context. The useful inquiry is narrower, more testable and easier to audit: what does the model receive on each screen, which named person approves the release, and what record of the run survives the session? Those three questions decide whether an agent is a helper in accounts payable or a second pair of hands on the bank account. The team can describe the process from memory, and the agent can complete the steps; what the team cannot produce after the fact is a record of what the model read and who released the run.
Key findings
- For an agent to release a payment run safely, the values on every invoice, vendor record and bank screen would have to be replaced with consistent tokens before the model reads them, with the real account resolving only at the approved destination (What Is a Protected Browser for AI Agents?).
- It would also require a named person approving the run itself, not each screen, and a record of what the model saw and who released it (What Is an AI Control Record?).
- None of the agent pages reviewed describes a payment-run approval; OpenAI's page offers a pause on "specific sensitive sites such as financial institutions" and no check on the run (OpenAI, Agent on Atlas, 2026).
- BILL's role page separates the person who can authorize a payment from the person who can enter a bill: "The Accountant role can manage the payables processes, but cannot pay bills" (BILL, 2025).
- Google Cloud's post says auto browse is "designed to pause and explicitly ask for your confirmation" for a purchase, which is one transaction rather than a fifty-invoice run (Google, New ways, 2026).
- SAP's invoice page states that an invoice over tolerance is "automatically blocked for payment" and that "you must release a blocked invoice in a separate step" (SAP, 2026).
Which agents ask before an action, and what does the confirmation cover?
A confirmation is a prompt at the end of a prepared action. OpenAI's Atlas payment page said the agent "will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions" (OpenAI, Agent on Atlas, 2026), and OpenAI retired the browser, which stopped working on August 9, 2026 (OpenAI, Retirement, 2026). Perplexity's Comet payment page says Comet "pauses for your confirmation regardless of whether our systems detect suspicious activity" when it must fill in a user detail it does not already know (Perplexity, 2026). Anthropic's Claude in Chrome page says Claude "takes screenshots of your active browser tab", and "whatever is visible in one of those tabs is captured in the screenshots and becomes part of the conversation" (Anthropic, 2026).
Each prompt covers a site, an unknown detail or a tab. None covers the batch. A payment run has a total, a pay date, a funding account, a payee list and an exception list, and those are the facts a controller approves. The prompts arrive after the page has been rendered to the model, so the person decides whether the action proceeds, not what the model read.
Gemini's page describes a purchase confirmation, and Claude asks for permission before a financial site; each is tied to one action.
What does a fifty-invoice run need that a screen confirmation does not give?
A fifty-invoice run is one batch: $184,000 across 43 vendors, a Friday pay date, one funding account, and three exceptions a clerk would flag (a vendor bank change, a duplicate invoice and a missing purchase order). The agent opens each vendor record and bill, matches what it can, and prepares the batch. The work is real, and the agent can do most of it.
What the run needs is one decision on that batch. Workday's guide describes a settlement run as one object: the operator adds "the unpaid open items and pending payments", edits exceptions, then clicks Process to launch the run (Workday, 2026). BILL's role page lists "Approve bills" and "Authorize payments" as Administrator permissions, which is the run authority a browser prompt does not represent (BILL, 2025). The approval names the total, the pay date, the funding account, the exceptions and the person who released it.
A screen confirmation cannot supply that decision, because the model sees the pages one at a time and the person clicks one at a time. Fifty prompts produce fifty decisions, and none shows the aggregate, the bank change or the duplicate. The bank debits one amount, and the auditor samples one run; the unit that matters is the batch, not the page. An approval that does not name the batch is a permission to continue, not a release.
What do the vendors themselves say?
Each vendor's own page describes a pause or a confirmation, and the same row carries the limit that matters to a payment run.
| Agent | What its page says | What to verify |
|---|---|---|
| OpenAI Atlas (discontinued August 2026) | Paused on "specific sensitive sites such as financial institutions"; could use signed-in sites (OpenAI, Agent on Atlas, 2026) | Whether the pause covers a prepared batch or one site |
| Perplexity Comet | "Pauses for your confirmation" when it fills an unknown detail (Perplexity, 2026) | Whether the model read the page before the prompt |
| Google Gemini in Chrome | Auto browse "is designed to pause and explicitly ask for your confirmation" for a purchase (Google, New ways, 2026) | Whether the prompt names the run total and payees |
| Anthropic Claude in Chrome | "Claude asks for permission before accessing financial sites"; screenshots capture what is visible (Anthropic, 2026) | What the screenshot captured before the permission |
| Microsoft Copilot | Actions run locally; no autofill, saved passwords or wallet, but cookies are in reach (Microsoft, 2026) | Whether local execution changes what the model reads |
The pattern is consistent. Each page describes a control at the point of action: a pause on a site, a prompt for a detail, a permission before a financial site, a local boundary. A payment-run approval is not described in the pages reviewed. The pages differ on the model's view: Claude captures what is visible, Copilot runs locally and can still reach signed-in cookies, and Atlas used the sites the person was signed in to. The third column asks whether the prompt arrives before or after the model reads the page. Across the 15 AI agents reviewed, six describe asking a person before they complete a payment or purchase, and the other nine do not describe it in the pages read (Do AI Agents Ask Before Making a Payment?).
What does an agent read on the vendor and bank screens?
The vendor record is not a summary. Oracle NetSuite's U.S.-only Intelligent Payment Automation setup requires a bank account on the vendor record, because "if a vendor record does not have a bank account, you can only pay vendor bills by check", and ACH needs "the Edit level for the following required permissions for ACH payments" (Oracle NetSuite, Vendors, 2026). A vendor record that carries a bank account, a remittance email and payment terms renders those fields on the page an agent opens to match an invoice.
BILL's Accountant role "is not able to manage users or view/manage banking information", so the page an Accountant sees is already shaped by role (BILL, 2025). A role decides which screens a person can open, and the page that opens still renders the account and routing fields to whoever is permitted to see them. The task may need the payee, the amount and the invoice number; the screen may also carry the account and routing numbers.
A model that reads the whole vendor record to match an invoice holds all of it (Can AI Work NetSuite Payables Without Bank Details?). The fields the task did not need are in its context anyway, and a later instruction can ask for one of them. The screen supplies every field it displays, including the ones the task does not need.
Who approves the release, and what does the record show?
An approval is a decision by a person with authority, and AP systems represent that authority as a role. BILL's page says "Administrators typically have signing authority on your bank account because they can authorize bill payments" (BILL, 2025). Workday's run screen then offers "Manage Payments" to edit details and "Manage Exceptions" for payments with exceptions before the run is processed (Workday, 2026).
The agent pages reviewed describe prompts, not approver identity. A prompt does not say whether the person is the controller, the clerk or someone who happened to be at the desk, and it does not record the name with the amount. The distinction is the one What Is Supervised Delegation? draws: a named person answers for the action, and the authority is attached to the work.
What a reviewer needs is the screen the model received, the action it proposed, the approval with a name, and the value that resolved at the destination (What Is an AI Control Record?). A confirmation that lives in the browser tab is not that record, because it does not leave the tab. An auditor asking why a payment moved needs the page as the model saw it beside the name of the person who released it.
What does a governed environment change?
The change is the unit of control. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.A governed environment replaces values on the rendered page with consistent tokens before any model reads it, so the agent can still match the invoice, check the payee and prepare the run on INV_014, VENDOR_014 and ACCT_014. The real account resolves only at the destination the policy names, at the moment a named person approves the action. The approval sits outside the model, so an instruction that reaches the model cannot approve its own release.
For the fifty-invoice run, the approval is on the run: the total, the pay date, the exception list and the funding account, with the approver's name attached. The record holds each screen the model received, each action and each approval, and the customer can export it. That record answers the two questions the audit asks, what the model saw and who released the value.
The definition of the render-layer control is in (What Is a Protected Browser for AI Agents?), and the two designs, a confirmation at the action and an approval on the batch, are compared in RedactSure vs Perplexity Comet: 2026 Comparison & Alternative. The control decides what the agent has to read before it can act.
What the record shows
The record on this page is a payment run. A confirmation that arrives after the model has read the screen governs the action that follows; it does not govern what the model read or who is accountable for the batch. The pages reviewed show pauses on sensitive sites, prompts for unknown details, permission before financial sites and local execution. A run of fifty invoices needs one approval on the batch, a named person who carries payment authority, and a record that pairs the screens the model received with that approval. A reader can test it by naming one run, one approver and one exception, then comparing the prompt the agent shows with the fields the model held when it prepared the batch.
Methodology and limitations
This page rests on the public documentation of five browser agents and four accounts payable systems, read between October 21, 2026 and October 27, 2026. The agent pages describe where each product places a pause or a confirmation; the AP pages describe how a run and a release step are represented. Public documentation read in full gives a sound view of where each product applies its control.
The products on this page are described from documentation and none was tested for this page. Not described in the pages reviewed means the recorded pages do not state the point, not that the product cannot do it; vendor features change and the page carries its date. The fifty-invoice run is a record type, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations belong to the organization's counsel and its own security and compliance officers. A pilot of one workflow on the organization's own screens is the only way to confirm what a model receives.
Frequently asked questions
Which AI agents ask before releasing a payment run?
None of the ones reviewed asks about the run itself. OpenAI's Atlas paused on sensitive sites, and the page described no check of a batch, a total or a pay date (OpenAI, Agent on Atlas, 2026). A run of fifty invoices needs an approval that names the batch and the person who released it, so the question is not whether the agent asks but what its question covers.
Does a confirmation prompt mean the agent asked before acting?
No. The prompt arrives after the page has been rendered to the model and the action has been prepared. It asks the person to allow or stop that action, and it does not ask what the model should have been allowed to read. A prompt can stop a payment; it cannot un-read the account number the model received earlier. The order of those two events is the part to check.
What does a fifty-invoice run need that a screen confirmation does not?
A single approval on the batch. That approval names the total, the pay date, the funding account, the payee list and the exceptions, and it carries the name of the person with payment authority. Fifty screen confirmations do not add up to that decision, because no screen shows the batch as one object. BILL's page separates payment authority by role: "The Accountant role can manage the payables processes, but cannot pay bills" (BILL, 2025). Ask which role signs for the run.
Who should approve the release?
A named person with authority over the bank account, not whoever is at the keyboard when the prompt appears. Authority is attached to a role and a person, and it should be checked before the run. A browser prompt does not check the role behind the click, and a session does not carry an approver's name. The approval should name the person and the run, and the record should keep that name beside the amount.
What record should remain after an agent prepares a run?
The record should show the screens the model received, the actions it proposed, the approval with the approver's name, and the value that resolved at the destination. A confirmation log inside a browser tab is not that record, because it does not leave the tab and does not show what the model read. An auditor asking why a payment moved needs the page as the model saw it beside the approver's name.
Can a payment run be safe if the model still reads the real account number?
No, not in the sense an auditor uses. A confirmation can stop a proposed action, and it does not change what the model already received on the page. If the account and routing numbers render as values, an instruction that reaches the model collects values, whatever the prompt says afterward. The condition that changes the answer is substitution before the model reads the screen, with the real account resolving only at an approved destination.
How RedactSure Puts a Payment Run Behind One Named Approval
A fifty-invoice run is released by whoever holds payment authority, and a browser confirmation on one screen does not name that person. BILL's role page says "The Accountant role can manage the payables processes, but cannot pay bills" (BILL, 2025).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent reads the account and routing numbers as the vendor record and bank portal render, and the record shows clicks, not the values it held. Inside, the screens render with ACCT_014 and ROUTE_014 before any model reads them, the real account resolves only at the destination a named person approves, and every screen and approval goes to the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A confirmation on one invoice screen does not answer for the other forty-nine. Bring a payment run from your own workflow and see, with test values, what the model reads, who approves and what the record holds. Book a demo