Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Who Approves an AI Agent's Change to a Vendor's Payment Details?
A named person in accounts payable, designated before the agent runs, approves every change to a vendor's payment details, and no cap or standing approval replaces that signature. Check what the model read on the vendor record before the change was prepared, and what record ties the approval to the values that changed.
A payee change is a small edit on a vendor record: a new account number, a new routing number. The edit takes a clerk under a minute, and it redirects every later payment to that vendor, which is why the signature on the change matters. When an agent prepares the edit it reads the record first, and the record is a rendered page that carries the digits the change replaces. The person who releases the change is therefore approving values they did not type, on a page they may not have opened, after a model has already read it. That gap leaves a controller four questions: which person signs, what the approval screen shows them, what the model received before they saw it, and what record joins the two. The worked record is a payee change held for approval in a vendor master file, a shape that recurs in any payables system. The vendor pages reviewed describe the fields the change passes through, and the fraud guidance describes the check a change needs; neither describes an approval attached to what the agent read, and that is the gap a buyer has to close before the first run.
Key findings
- For a payee change to be governed rather than merely reviewed, the values on the vendor record would have to be replaced with consistent tokens before any model reads the screen, so the agent prepares the edit from ACCT_014 and ROUTING_014 and the real digits resolve only at the approved destination (What Is Supervised Delegation?).
- It would also require a named person approving each change, with a record that ties that signature to the values that changed and to the screen the model read, because an approval that can show neither is a name without an object (What Is an AI Control Record?).
- None of the pages reviewed describes an approval attached to the agent's change: NetSuite's Pay Single Vendor form says "In the Payee field, select the payee you want to pay" and documents no second signature on the vendor record (Oracle NetSuite, 2026).
- Chase Connect makes approval a per-account right, "Approve pending transactions within an account for that user," a control on the release and not on the vendor record the agent edited (Chase, 2026).
- The FBI's business email compromise advisory tells businesses to "Use secondary channels and/or two-factor authentication to verify requests for changes in account information," a check on the request and not on the model that prepared it (FBI IC3, 2024).
Who approves the change, and what exactly are they approving?
The approver is a person with authority over the vendor master, not the agent that prepared the edit and not the vendor whose page confirms it. That person is usually the controller or AP manager, and the approval worth having names a specific vendor, the old account number and the new one, effective for every payment after it. An approval that names a payment amount but not the changed account approves the wrong object.
Chase Connect shows how far a bank-side right reaches. Permission to "Approve pending transactions within an account for that user" lets a named user release a payment, and its "See activity only" level covers users who cannot approve (Chase, 2026). Neither right changes a vendor's bank details, which sit in the customer's payables system, and the guide does not show the fields of the approval screen. The bank's dual control also stops at the release: Dual Control-Transaction requires that "all transactions will automatically require approval by another user" (Chase, 2026).
Google's Agent Payments Protocol describes its mandates as "cryptographically-signed digital contracts that serve as verifiable proof of a user's instructions," which records what a person authorized and does not name who approved a change to a vendor's account (Google Cloud, 2025). That is the distinction What Is Supervised Delegation? draws between connecting an agent and answering for an action.
Approval by default is the exception among the agents reviewed: 1 of the 15 documents asking a person by default before every consequential action (Do AI Agents Ask Before Making a Payment?). NetSuite, QuickBooks and Chase fall outside that set, so the figure describes the agent products reviewed rather than their own approval steps.
What does the agent read when it opens the vendor record?
The worked record is a payee change held for approval. The vendor record opens on a form that shows the legal name, the remit-to address, the payment method, the bank account and routing numbers, the tax identifier and the change history, and the agent reads every field as the page renders, including the digits the change replaces.
NetSuite's help documents the payment transaction and not an approval of a change to a vendor's bank details: "Use the Pay Single Vendor transaction to pay for outstanding payables to one vendor," and "In the Payee field, select the payee you want to pay," after which checking the electronic bank payment box clears the check options, so the form governs how the payment leaves rather than who approved the account it leaves for (Oracle NetSuite, 2026).
QuickBooks Online reaches the bank details from the payee line, where the answer says "You'll need the account number for the vendor" (Intuit, 2021).
| Screen in the change | What the model receives | What the approver needs |
|---|---|---|
| Vendor record | Legal name, remit-to address, account and routing numbers, tax identifier | The fields that will change |
| Change request | Proposed account and routing numbers, requester, date | Old and new values side by side, and the channel the request arrived on |
| Payment run | Payee, amount, account to be debited | Which account the payment will debit, and who released it |
By the time a person opens the change request, the model has already read the record, and the values it read stay in the run's context for the rest of the task, which is the exposure What Is an Approved Destination for AI Agent Output? treats as the place to close. The approval has to arrive before that reading, or it approves a change the model already knows how to repeat.
What do the vendors themselves say?
The pages reviewed describe where a payee and a bank account are edited, and the closest any comes to an approval is a right held at the bank.
NetSuite's Pay Single Vendor form is a reference for the transaction, and it shows where the payee is chosen without describing who approves a change to the vendor's account. The form lists the payee, currency and posting period, fields a clerk works through and not a second signature on the vendor record (Oracle NetSuite, 2026).
The QuickBooks answer covers setup and describes no approval step. It directs a user with open bills to "select Set up Bank Transfers within the same line as the Payee," after which the user enters the bank account information and saves, and it states that "You'll need the account number for the vendor" (Intuit, 2021). It is a moderator's answer from 2021 and names no field labels.
Chase's guide is the one page that names approval, and its approval belongs to a transaction at the bank: it lists "Approve pending transactions within an account for that user" and a Dual Control-Transaction option that requires "approval by another user," which covers a release and not a customer's payee change (Chase, 2026).
The 2025 AI Agent Index records approval requirements for Glean's agents as "None found, in the actual agent," the default a named approver has to replace (AI Agent Index, 2026).
The pages document three permissions: edit the vendor record, release a payment, and administer the bank account.
What does the fraud record say about a change of account?
The fraud record treats a change of account as the moment to verify, in the advisory on business email compromise and in the account validation rule that governs a debit from a new account number.
The FBI's advisory tells businesses to "Use secondary channels and/or two-factor authentication to verify requests for changes in account information" (FBI IC3, 2024). The advice is aimed at the request rather than at the model that reads it.
Nacha's rule reaches the changed account from the debit side: the supplemental requirement "applies to the first use of an account number, or changes," and "a fraudulent transaction detection system must, at a minimum, validate the account to be debited" (Nacha, 2021). The page is an archived change notice, it applies to WEB debit originators, and it prescribes no method; it validates the account and says nothing about the person who approved the change.
Meta's Rule of Two explains why an agent makes the problem harder: "Agents must satisfy no more than two of the following three properties within a session," and a payee change carries all three, because it involves untrusted input, sensitive data and an external state change (Meta AI, 2025).
The design-patterns paper puts the constraint directly: once an agent ingests untrusted input, "it must be constrained so that it is impossible for that input to trigger any consequential actions," which means the release cannot be reachable from the model's reading (Beurer-Kellner et al., 2025).
What should a security team ask for in writing?
Ask what the model receives from a rendered screen before the change is prepared: the full account and routing numbers, consistent tokens such as ACCT_014, or nothing at all. The answer sorts a tool faster than any feature list, so ask for that answer in writing.
- Who is the named approver, by role and by name, and is that person different from the employee who connected the agent?
- Does the approval screen show the old and new account values side by side, and the channel the request arrived on?
- Is the approval bound to the values that changed, so a later edit cannot ride on an earlier signature?
- Where does the record live, what does it contain, and can it be exported to the organization's own monitoring?
A role without a name, or an approval without the changed account, leaves the gap the pages reviewed leave. What Stops an AI Agent From Making Unauthorized Changes? and Do Coding Agents Break Separation of Duties? apply the test to the agent's side, and How Do I Set Credential Approval Rules for My Whole Team? covers the standing rules a team writes once.
What does a governed environment change?
A governed environment changes the object of the approval. Values chosen by policy, the account number and routing number on the vendor record among them, are replaced with consistent tokens before any model reads the screen, so the agent prepares the change from ACCT_014 and ROUTING_014 and the approver sees the same tokens. The real digits resolve only at the approved destination, at the moment of an approved action, which means the release a person signs carries values the model never held.
That changes what the approver is looking at. In the ungoverned version the change request shows the old and new digits, and the model has read both; in the governed version the approver sees the tokens, the real values behind them, and the name on the signature. A named person approves each change, so the decision is about released values rather than about a page the model already read, and the record of the screen, the action and the approval exports to the organization's own monitoring.
The comparison for one family of privileged tools is set out in RedactSure vs CyberArk, which places the control on the record the agent opens rather than on the agent's identity. That is what an approval needs.
What the record shows
What settles a payee change is a signature from a named person on the values that changed, recorded beside the screen the model read. A change prepared by an agent therefore has two questions to answer before it is released: what the model received from the vendor record, and who answered for the release. A payables team should check this week with one vendor and one change. Request a change to a test vendor's account number, capture what the model read on the record and on the change screen, then compare that capture with the approval record and the account the next test payment used. If the capture holds the real digits, the approval arrived after the exposure.
Methodology and limitations
This page rests on vendor documentation from Oracle NetSuite, Intuit and Chase, vendor research from Meta and Google Cloud, the FBI IC3 advisory and Nacha's rule page, the 2025 AI Agent Index, a preprint on agent design patterns, and RedactSure research pages. Vendor pages were read as of October 22, 2026. Public documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested for this page, and "not described in the pages reviewed" means the pages reviewed. The NetSuite page is a form reference and the QuickBooks answer a moderator's post from 2021, so neither is a specification of current behavior; vendor features change and the page carries its date. The example describes a record type, not an organization. Determinations about whether a payment change meets a contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers.
Frequently asked questions
Who approves an AI agent's change to a vendor's payment details?
A named person in the customer's accounts payable team, with authority over the vendor master, approves it, and that person is designated before the agent runs. The agent prepares the change; it does not release it. A bank's per-account approval right or a vendor's confirmation screen is not that approval, because neither is bound to the values that changed. The approval has to name the vendor, the old account and the new one.
Does a confirmation from the vendor or the bank count as approval?
No. A confirmation shows that a page accepted a value, and it arrives after the model has read the record. It shows neither who answered for the change nor what the model received before it was prepared. Chase's guide is explicit that its approval rights govern transactions within an account, which is a release at the bank (Chase, 2026). Treat a confirmation as evidence that the edit landed, not as the signature on it.
What does the agent see on the vendor record?
Whatever the record renders, including the bank account and routing numbers the change will replace, unless those values are substituted before the model reads the screen. QuickBooks Online asks for the account number on the payee line, and the answer says "You'll need the account number for the vendor" (Intuit, 2021). The model holds the digits for the rest of the run.
Is bank dual control enough for the change?
Only for the release. Chase's Dual Control-Transaction setting requires that "all transactions will automatically require approval by another user," which puts a second person on the payment (Chase, 2026). The vendor record sits in the customer's payables system, and the bank guide does not describe an approval attached to it. A team that relies on dual control alone still has an unapproved edit behind an approved payment.
What record should exist after the change?
A record that shows the vendor, the old and new account values, the screen the model received, the person who approved the release, and the time. It should export directly to the organization's own monitoring rather than stay in a vendor's dashboard. What Is an AI Control Record? describes the join: the evidence has to answer what the model saw and who answered for the action, and a payee change needs both halves on one page.
Can a threshold or a cap replace the approver?
No. A payee change is not sized like an invoice, so a dollar threshold does not sort it. One edit redirects every later payment to that vendor, whatever the next invoice is worth, which is why the fraud guidance asks for verification on the change itself (FBI IC3, 2024). A cap on invoice amounts leaves the account number that receives every later payment untouched.
How RedactSure Keeps a Payee Change Behind a Named Signature
An approval that follows the record edit releases a change the model may already have read, and the controls reviewed here govern the payment, not the page. Nacha applies validation to a changed account number and names no approver.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the change request opens on the vendor record and the model reads the account digits the page displays. Inside: the record renders as PAYEE_014, ACCT_014 and ROUTING_014, the agent prepares the edit on those tokens, and the real account number resolves only when a named controller releases the change.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A changed account number redirects every later payment, so the signature on the change is the one that counts. Bring a vendor change from your own workflow and see, with test values, what the model reads and who approves the release. Book a demo