Authority boundaries for procurement agents

A procurement agent finds a lower price, asks the supplier for a discount and places an order below the team’s approval threshold. Each action appears reasonable. Together they may create an unauthorised representation, bypass an aggregate spending limit and commit the organisation to terms nobody reviewed.

Procurement authority is not one permission called “buy.” It is a chain of distinct powers: to search, disclose requirements, invite offers, evaluate suppliers, negotiate, approve, commit, receive and pay. An agent needs an explicit mandate for every link it can exercise.

Separate assistance from representation

Start by distinguishing internal preparation from external conduct.

Activity	Typical starting position	Why the boundary matters
Search catalogues and approved frameworks	agent may assist	low commitment, but source quality still matters
Draft requirements or comparison	agent may prepare for review	errors can distort competition or fit
Contact a supplier	approval or constrained template	the message may disclose information or imply authority
Negotiate price or terms	human-led or tightly mandated	a concession may bind later positions
Select a supplier	accountable decision with evidence	fairness, conflict and value judgements apply
Issue a purchase order	approval-gated execution	creates an external commitment
Change supplier master data	separate high-control process	fraud and payment diversion risk
Approve invoice or release payment	segregated role	must not collapse ordering and payment controls

Do not let a conversational interface obscure this progression. A request such as “get us the best option by Friday” is not a sufficient mandate to contact suppliers, accept click-through terms or spend money.

Build an authority matrix that uses more than price

Define permitted actions by value, category, supplier state, term, data exposure and cumulative commitment. A low-cost service can still process sensitive data, introduce operational dependency or accept unfavorable intellectual-property terms.

For each action, specify:

• the identity on whose behalf the agent acts;
• allowed suppliers, categories and jurisdictions;
• transaction and aggregate value limits;
• approved contractual terms and prohibited deviations;
• data that may be disclosed during sourcing;
• required conflict, sanctions and security checks;
• the approver for exceptions; and
• expiry, revocation and emergency-stop conditions.

Public procurement policy offers a clear control pattern. The UK Regulator of Social Housing’s procurement policy connects contract approvals, authorised signatories, financial delegations and segregation of duties. Organisations will have different rules, but the design principle is transferable: the agent’s credentials must enforce the mandate rather than depend on the agent remembering it.

Treat supplier content as untrusted input

A procurement agent will read catalogues, proposals, contracts, emails and websites. Those materials can be inaccurate, outdated or intentionally instructive. Text inside a proposal must never be able to redefine the agent’s objectives, add a tool permission or suppress required checks.

Separate data from instructions. Parse external documents in an isolated environment, restrict links and downloads, and require provenance for extracted claims. Test prompt injection explicitly: place an instruction in a supplier document telling the agent to mark the vendor approved or send confidential budget information. The correct behaviour is to treat it as content and continue the governed workflow.

NIST’s AI RMF calls for third-party risks, components and controls to be mapped and documented (AI RMF Core). Its playbook also recommends transparency into third-party system functions, testing and clear usage instructions. Procurement agents need those protections both as AI systems and as systems that assess suppliers.

Keep evaluation evidence inspectable

An agent can help normalise bids, identify missing responses and trace requirements to evidence. It should not convert uncertainty into a confident ranking.

Preserve the original offer, extraction, normalisation rules, scoring method, exceptions and human changes. Show which criteria were mandatory, which involved judgement and which evidence was absent. Test whether small wording differences, document order or supplier identity cause inconsistent scoring.

The OECD describes uses for AI in procurement such as document processing, risk flags and compliance checks, while warning about skewed data, lack of transparency and scaled unfairness (AI in public procurement). Use automation to surface evidence and inconsistencies; retain accountable judgement for trade-offs, exclusions and award.

Control external communication and negotiation

If an agent communicates with suppliers, constrain the channel, template, timing and representations. It should identify itself appropriately, preserve the exchange and avoid claims it cannot substantiate. It must not invent deadlines, disclose competitors’ information or promise an award.

Negotiation requires an approved position envelope. Record the opening position, permitted concessions, non-negotiable terms, approval triggers and expiry. A supplier counteroffer outside that envelope should stop the agent, not invite creative compromise.

Test cumulative behaviour. An agent may make several small concessions that together exceed its mandate, or issue multiple low-value orders that bypass an aggregate threshold. Evaluate spend and obligation over supplier, category, project and time—not only per action.

Reconcile commitments and preserve challenge routes

After an order, verify that the supplier received exactly the authorised instruction and that the procurement system records the same commitment. Distinguish a confirmed order from an uncertain network result before retrying. Link receipt, invoice and payment checks without allowing the agent to approve its own chain.

Suppliers and internal users need a route to challenge errors. Preserve the decision record, identify who can amend or cancel the commitment and define how urgent operational needs are handled when the agent is unavailable.

Exercise a purchase from request to receipt

Use a scenario that combines ordinary work with boundary pressure. A team requests a standard service from an approved supplier, but the new quote changes the data-processing location, renews automatically and exceeds the annual aggregate limit when existing orders are included. The agent should detect the changed terms and cumulative exposure, preserve the valid comparison evidence, and route the decision to the appropriate commercial, security or legal review instead of treating the familiar supplier as pre-approved.

Continue the test after approval. Confirm that the purchase order contains the authorised version, the supplier acknowledges the same terms, the receiving evidence matches the order and the invoice does not introduce a different account. This end-to-end exercise shows whether governance survives system handoffs rather than existing only in the sourcing interface.

Score the agent’s explanation as well as the route. The approver should see why the familiar purchase became exceptional, which evidence changed and which authority is needed next. A generic risk warning that forces the reviewer to rediscover the issue is not an effective control.

Release by mandate, not by capability

Test the procurement agent on boundary cases before granting authority: a new supplier with changed bank details, a split order, a conflicting quote, an embedded instruction, a restricted data request, a late bid and an uncertain purchase-order result.

Then release in stages:

1. discovery and evidence organisation;
2. comparison and recommendation;
3. approved supplier communication;
4. approval-gated purchase execution; and
5. narrow repeat ordering only where the mandate and reconciliation are proven.

The decisive question is not whether the agent can complete a purchase. It is whether every external statement and commitment can be traced to a current mandate, an accountable approval and a confirmed outcome. When those controls blur, the agent should stop.