The agent matched the PO, matched the receipt — and approved a $48,000 invoice on its own.

An AP agent gets a reasonable mandate: match invoices to purchase orders and receipts, approve the clean ones, flag the exceptions. It does this well — that is why it was deployed. But "clean match" and "within authority" are different tests, and only one of them lives in the agent's prompt.

The $48,000 invoice matches perfectly. The vendor is real, the PO is real, the goods were received. The agent approves it because nothing in its instructions distinguishes this invoice from the two hundred small ones it approved the same week. Quarter-end close arrives, the auditor samples disbursements, and the firm now has a documented instance of an automated approval above the delegated limit — a segregation-of-duties finding, regardless of whether the payment itself was correct.

In the live control plane, money movement is a gated category with an amount threshold the agent cannot see, negotiate, or reinterpret. Below the limit, the approval runs and a receipt is written. Above it, the action lands in the approval queue for a named owner — before anything posts to the ERP.

• AP agent approvals above the delegated-authority limit never auto-run — they queue for a named approver.
• The threshold is enforced in an external policy engine, not in the agent's prompt or the ERP integration user's permissions.
• Every approval — human or agent — records amount, matching evidence, policy version, and approver identity.
• New-vendor and changed-bank-detail invoices route to a human at any amount.
• Review the approval queue weekly: repeated above-limit attempts from one workflow mean the mandate, not the agent, needs fixing.

Amount thresholds are one slice of the same category rule that governs support refunds above the limit and external-party actions. For the accounting-firm view of client-facing agent risk, see accounting firm AI governance.