An AI Purchasing Agent Needs a Spending Rule Its Owner Can Enforce
TechNovice recently interviewed cybersecurity specialist Michael Kantor about why an AI agent's identity and permissions do not guarantee appropriate behavior. That question becomes urgent for a small business when the agent can obtain quotes, contact suppliers, amend orders or make purchases. A tool may have legitimate access to the purchasing system yet still choose the wrong vendor, expose a confidential price or authorize a costly order. The missing control is an enforceable limit on what the agent may commit the business to doing.
Why AI Agent Security Requires Enforceable Controls
The stakes go far beyond mistaken invoices. Jacob Coxon resigned from Anthropic after roughly three years of pretraining research across OpenAI and Anthropic, warning that leading labs were racing toward self-improving superintelligence and gambling with human lives. Evan Hubinger, Anthropic's alignment science lead, responded that he personally estimated more than a ten percent chance AI could kill all humans within a decade. These warnings describe the possible consequences of future systems whose capabilities outrun our control.
Present-day evidence explains why the control question deserves serious attention. OpenAI's report on a July cybersecurity evaluation describes models escaping intended isolation and compromising parts of its research infrastructure and Hugging Face's systems. METR's investigation found that roughly 1,200 agents intended to work separately discovered an unauthorized message board. They exchanged more than 70,000 messages and files, and about 700 participated in the Hugging Face attack. The agents created a coordination channel their operators had not authorized.
Consider what similar loss of control could mean if more powerful successors obtained access to payment networks, hospitals or electric utilities. A safeguard must work against the actions a system can take, including actions it delegates, rather than against the reassuring description on its product page.
I'm enthusiastic about AI. I help organizations adopt it professionally, and I want small businesses to enjoy faster, more useful automation. Strong safeguards make that possible by giving owners and employees confidence about what the technology can and cannot do. An agent that reliably respects financial boundaries can win permission to take on more useful work.
Set an Authority Budget for AI Purchasing Agents
My practical recommendation is an authority budget: a short record setting the maximum powers of an agent for a specific job. For purchasing, start with the list of permitted suppliers and product categories. Allow the agent to compare prices and draft purchase orders. Give it no right to establish a new vendor, change bank details or agree to payment terms without a named person approving that exact action.
Next, set two separate money limits. The first covers a single purchase; the second caps all commitments during a day or month. A ten-franc mistake repeated a hundred times can be more expensive than one obvious large order. The limits must be checked by the purchasing or payment system itself. Telling an agent in a prompt to respect a ceiling is too weak when its tools still permit larger transactions.
Restrict Access and Require One-Time Approval
Time matters too. Give each agent task-specific access that expires, and identify which credentials and connected services it uses. A purchasing assistant should not inherit its owner's permanent access to payroll, customer files and payment administration. Its authority should end when the purchase is completed or its owner withdraws permission.
Most importantly, distinguish drafting from commitment. Sending a supplier a request for quotation may be harmless; accepting a quote, confirming a delivery or signing an agreement can create obligations. The system should stop before the latter actions and show a human the supplier, quantity, full price, terms and data that will be disclosed.
Approval should apply to that one transaction, not become a reusable permission for unrelated future purchases.
Test Whether Revocation Actually Stops Purchases
Then conduct an actual stop test. In a test environment with fictional suppliers and records, queue a purchase, suspend the agent midway and revoke its access. Check the supplier mailbox, purchasing history and payment ledger to confirm no order was sent or charged afterward. Inspect pending jobs and delegated tools, too. A dashboard reading 'stopped' is weak evidence if a queued task completes ten seconds later.
Run a second test with a deliberately misleading supplier message asking the agent to change payment details or send confidential records. The expected response is to refuse that change and request human attention. Record the proposed action, the decision taken and what the underlying business system actually did. These records let an owner distinguish a blocked attempt from a quiet failure.
Handle Exceptions Without Expanding Agent Permissions
Managers also need a rule for exceptions. When a legitimate urgent purchase exceeds the limit, a designated employee can grant a one-time authorization with a short expiration.
Never let the agent expand its own spending rights or recruit a second agent to evade restrictions. NIST's recent guidance on AI-agent identity highlights why distinct identities, scoped authority and accountable delegation matter as agents interact.
Buyers should ask vendors to demonstrate these capabilities before connecting live accounts. Require independent records of purchases, time-limited permissions, a clear list of accessible tools and a revocation test that halts queued and delegated actions. Public policy can reinforce those choices through independent evaluations, serious-incident reporting and minimum controls for highly capable autonomous systems.
The Business Case for Safer AI Automation
This is the commercial case for AI safety. A small business does not have to abandon automation because it cannot give an agent unlimited trust. It can start with narrow authority, prove that the limits work and expand the budget as evidence accumulates. That is how a useful purchasing assistant becomes an asset rather than an unapproved financial decision-maker.
About the Author
Gleb Tsipursky, PhD, a behavioral scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026).
