Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Who Approves an AI Agent's Purchase Order?
Below the limit delegated to it, the agent can approve a routine purchase order; above it, a budget owner with that authority must, and the limit belongs in the environment's policy rather than in the agent's instructions. Ask where the threshold is stored, what the model reads on the approval page, and whose name the record carries.
A purchase order is a promise to spend, and every organization that lets an agent raise one has already answered the authority question for its staff. The staff answer is written into the ERP: Oracle NetSuite routes an order above an employee's purchase limit to that employee's supervisor, SAP holds an invoice above its tolerance for payment, and Coupa records an approver and an approval date against an approval chain (Oracle NetSuite, Approval, 2026; SAP, 2026; Coupa, Approvals API, 2026). An agent that opens the approval page with a borrowed login inherits the page rather than the policy behind it, so who approves turns into a question about where the threshold is kept and what the model reads when it reaches the page. An order approved above the limit that should have stopped it is a payment the organization cannot defend in an audit, and the person whose login it used is left holding it. Delegated authority is older than software; what changed is that the delegate now reads the page and acts on it in the same step.
Key findings
- For an agent to approve a purchase order above a threshold safely, the amount has to be checked against a limit the environment enforces, with anything above it routed to a named budget owner before the model can act, and the page rendered as consistent tokens (What Is Supervised Delegation?).
- It also requires the model to read a token where the vendor's bank details and the approver's identifier sit, with the real values resolving only at the approved destination and each approval written to a record that names the person who gave it (What Is an AI Control Record?).
- None of the vendor pages reviewed says what an agent holding a login reads on the approval page, and none describes a limit that binds the agent rather than the person (Oracle NetSuite, Approval, 2026).
- Oracle NetSuite's help states that approval steps depend on "the employee's expense limit or purchase limit" with the example that "the employee's supervisor must approve all purchase orders over $500", a rule about a person's authority that names no agent (Oracle NetSuite, Approval, 2026).
- SAP's invoice verification holds an invoice above its upper tolerance for payment until someone releases it, so the hold sits on the record rather than on the model that proposed the payment (SAP, 2026).
- FINRA's 2026 oversight report flags that "Agents may act beyond the user's actual or intended scope and authority," the failure an approval threshold exists to catch (FINRA, 2025).
Who approves the purchase order, the agent or the budget owner?
The authority to approve a purchase order is delegated, and delegation is written as a limit. A buyer with a $10,000 ceiling can commit $9,000 without asking, and that buyer's $14,000 order goes to a budget owner who holds a larger limit. Below the delegated limit the agent approves, and above it a person does.
That person is the budget owner named on the order, not the agent's operator and not whoever holds the login. In the record used here, a $14,000 order against a $10,000 delegated limit is held at the approval step, and the approver field carries the owner's name. The agent's part ends at the hold unless it can press approve, which is why its identity matters more than its instructions.
Most teams write the limit where the model will read it, as a line in the system prompt, and that is a request rather than a boundary: once an agent ingests untrusted input, "it must be constrained so that it is impossible for that input to trigger any consequential actions" (Beurer-Kellner et al., 2025). A limit that sits in the environment binds the action instead, because the amount is compared with the threshold by code outside the model.
Workato's Coupa approval tool shows which rights an agent uses: it approves a pending item after showing the document summary and obtaining confirmation, runs with the approver's own Coupa rights, and returns a permission-denied outcome when the permission is missing (Workato, 2026). How Do You Set a Spending Limit for an AI Agent? works the money side, and Can a Coding Agent Escalate Its Own Permissions? follows an agent testing the edges of its instructions.
What do the vendors themselves say?
Oracle NetSuite's help states that approval steps depend on "the employee's expense limit or purchase limit", with the page's example that "the employee's supervisor must approve all purchase orders over $500" (Oracle NetSuite, Approval, 2026). The feature needs an administrator to enable it, designate an approver and set a limit for each employee.
SAP's invoice verification compares the invoice, the purchase order and the goods receipt against a tolerance, and blocks the invoice above it for payment, with the block covering all items in an invoice (SAP, 2026). The block is a state on the record, so it survives a reload and a retry.
Oracle's Payables setup names where each control lives rather than how a clerk applies it: the match approval level is set in the Purchasing Options window, the Suppliers window or the purchase order shipment, and the hold on unmatched invoices sits in Financials Options, Payables Options or the supplier record (Oracle, Matching, 2026).
Coupa's approval data carries an approver, an approver-type, an approval-date, a delegate and an approved-by field, and the approval must be Pending for an action on it to be valid (Coupa, Approvals API, 2026). The page states no permission or role requirement, so it records who approved and leaves who may approve to the implementation.
For the agents that work those pages, only 6 of the 15 AI agents reviewed document asking a person before completing a payment or purchase, and 9 of 15 do not describe that step (Do AI Agents Ask Before Making a Payment?).
What does the agent read on the approval page?
The approval page renders like any other page. Take the purchase order above its limit, held for the budget owner: the screen carries the order number, the vendor's name, the amount, the cost center, the tax identifier, the approval route with the budget owner at the current step, the vendor's bank details in the linked supplier record, and the approval history.
An agent that opens that page with a computer-use tool receives everything the page renders. The bank details, the tax identifier and the budget owner's name arrive in the same context as the amount, so an agent with no business reading the supplier's account still holds it. The one part an ordinary session leaves to the model is the comparison against the limit: the threshold is text on the page, and the agent decides whether the amount is above it.
An approval attaches to the action rather than to the credential, the distinction Does a Coding Agent Need Approval Before Using a Credential for the First Time? draws for a different record.
| What the approval page holds | What an ordinary session sends the model | What a governed environment sends instead |
|---|---|---|
| Amount and currency | The full figure, here $14,000.00 | The figure, with the limit comparison made outside the model |
| Vendor bank details | The account and routing numbers from the supplier record | Tokens such as ACCT_002, resolved only at the payment the owner approves |
| Budget owner and route | The approver's name and the earlier steps | The same name and role, with the approval taken on the owner's own credential |
| Tax identifier | The vendor's tax number in full | A token such as TAX_014 |
| Approval history | Each earlier step, its actor and timestamp | The same history, and a copy in the control record |
The table is the check a buyer can run on the tool in front of them: name each row and ask what the model received for it.
What record should an agent's approval leave?
An approval that cannot be produced later is an approval an auditor will not accept. The record needs four things: the order and the amount, the rule that was applied, the person who approved, and what the agent read before the approval.
Coupa's API shows how much of that a procurement system holds: an approver, an approver-type, an approval-date, a position, a delegate and an approved-by field (Coupa, Approvals API, 2026). None of those fields says what the agent saw, and none distinguishes an approver who read the order from one who was shown the agent's summary of it.
The visibility work names the missing measures: agent identifiers, real-time monitoring, and activity logging, so the agent appears in the approval history beside the person (Chan et al., 2024).
FINRA's 2026 oversight report adds why this matters for agents: "Complicated, multi-step agent reasoning tasks can make outcomes difficult to trace or explain, complicating auditability" (FINRA, 2025). A phone approval has to feed the same record (Can I Approve an Agent's Credential Request From My Phone?), and the security sign-off before a rollout asks for the evidence in writing (How Do I Get Security to Approve Autonomous Coding Agents?).
What does a governed environment change?
A governed environment is a control class that acts where the screen is rendered and at the point an action is committed. Values chosen by policy are replaced with consistent tokens before any model reads the page, so an agent working the approval screen sees the amount and ACCT_002 in place of the supplier's bank account. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. The authority limit is code the environment runs: an amount above the delegated threshold opens an approval step, a named person completes it on their own credential, and the real values resolve only at the approved destination at the moment of that approval.
The DAPLab position paper reaches that conclusion from outside the products: access control governs who can touch data and integrity constraints govern what gets stored, but neither governs how data flows during agentic execution, so the risk has to be absorbed by the environment (Columbia DAPLab, Data Environments, 2026).
That is the line the comparison pages draw between a control that sees a screen and a control that sees traffic, for instance RedactSure vs Cyera: 2026 Comparison & Alternative. The governed environment does not cover the terminal, the IDE, a direct API call or MCP, so an agent that approves through an API from a shell needs a separate control.
What the record shows
An approval holds only when the amount is compared with a limit the environment enforces, the budget owner above it is named before the order moves, and the record shows what the agent read on the screen. The vendor pages reviewed establish the first two: approval routing by an employee's purchase limit, an invoice block that holds above tolerance, an approval chain with an approver and a date. They stop at the person the login belongs to, and none of them describes the values a model receives on the approval screen. The gap decides the outcome: an agent that reads the bank details carries them into every later step, and one that reads a token carries a token. For a first test, take one purchase order just above its delegated limit, run it with the agent's own login, and write down the amount the model saw, the name in the approver field, and whether the record shows the values the model read or only the decision.
Methodology and limitations
This page rests on vendor documentation from SAP, Oracle, Oracle NetSuite, Coupa and Workato, two research papers, an industry analysis and FINRA's 2026 oversight report. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested for this page, and each is described from its public documentation; a feature released after the read date is unreviewed. Where a page is silent, this page says not described in the pages reviewed, a statement about the pages rather than about the product. The page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a purchase order held at an approval step, and not an organization. Determinations about whether an approval flow meets a contractual, audit or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers; nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Who approves an AI agent's purchase order?
The budget owner whose limit the order exceeds, when the system enforces the limit that way; the agent approves only inside the authority delegated to it. That is how staff purchasing already works, and it is the shape Oracle NetSuite's approval routing describes. What stays open is whether the agent's approval rights come from a policy or from the login it holds, because a login with approval rights answers to whoever owns it.
Can an AI agent approve a purchase order on its own?
Yes, within a limit someone delegated, and that is a decision about authority rather than about autonomy. An agent can press approve only where the system gives its user that right. The review question is therefore which rights the agent's identity carries and whether those rights come from a policy the organization can point to, not whether the agent seems trustworthy.
Does an approval prompt in the agent's instructions count as a limit?
No. A prompt or a tool description is text the same model reads, and the model that reads the limit also reads the vendor's email. The design-patterns paper's condition is that untrusted input must be unable to trigger a consequential action, and only a check the model does not run can meet it. An instruction can be argued with, ignored or lost in a long context.
What does the agent read on the approval page?
Everything the page renders, in an ordinary browser session: the amount, the vendor's remittance account, the tax identifier, the approval route, and the earlier steps with their names and timestamps. Nothing on the page separates the field the agent needs from the ones it does not. A governed environment replaces the values chosen by policy with tokens before the model reads the page, so the agent approves an order it can see without holding the supplier's bank details.
What record should an agent's approval leave?
The order and the amount, the rule that was applied, the person who approved, the agent that prepared the order, and the values the model saw at the approval step. Coupa's API already returns an approver, an approver-type and an approval-date; what it does not return is the page the agent read. The record is how a reviewer tells an approval made on the order from one made on an agent's summary of it.
What should a finance team ask a vendor in writing?
Where the delegated limit is stored and who can change it, which identity the agent uses and what approval rights that identity carries, what the model receives from the approval screen, and what the approval record holds about the agent. Ask for the answers against one order held above its limit, because a vendor that cannot show the hold cannot show the control. Repeat the run after the next release of the agent.
How RedactSure Holds a Purchase Order Above Its Limit
An approval threshold set on a screen decides who may act, and the pages reviewed stop short of what the model reads on that screen. NetSuite's example has a supervisor approve every purchase order over $500, a rule that ends at the person.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the held order and reads the amount, the supplier's remittance account and the budget owner's name. Inside: the amount is checked against the delegated limit outside the model, the account renders as ACCT_002, and the owner's approval releases the real values to the payment.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A purchase order above its limit shows whether an approval is enforced by the environment or by an instruction. Bring one order and see, with test values, what the model reads, who approves, and what the record holds. Book a demo