Always-On Procurement Agent

A bank wants an always-on agent to process routine purchase requests: check them against policy, chase missing quotes and prepare purchase orders. Internal audit and model risk will review it.

• 1Which request types and amounts are routine?
• 2What are the approval limits?
• 3Which systems can the agent read and write?
• 4How is supplier fraud detected today?
• 5Who owns the agent?

• Agent must not hold a person's credentials
• No changes to supplier bank details
• Every action auditable by internal audit
• Model risk review before production

• Non-human identity with scoped access
• Risk-tiered approval policy in code
• SIEM audit logging
• Shadow-mode evaluation on past requests
• 90-day pilot with exit criteria