Seven money rules before agents touch purchases, refunds or invoices.
An AI agent can now order lunch for the team after a person approves the purchase. That sounds like a small convenience. It is also a serious management test.
The approval answers one question: Did someone authorize this spend request? It does not automatically answer which company policy allowed the purchase, whether the agent chose the right supplier and quantity, where the receipt will land, who will reconcile the charge, or what should happen if the result is unclear.
That distinction matters because AI agents are moving from recommending work to preparing and completing business actions. On October 21, Stripe and Anthropic announced that Claude Duet can use Link to make purchases that a user approves. The same announcement describes a separate Stripe connector that can support account actions such as sending invoices and payment links, managing products and prices, analyzing revenue, and issuing refunds.
The product safeguards are real. Anthropic describes Claude Duet as a waitlisted research preview beginning with US Pro and Max subscribers, and says important actions wait for user approval. Link uses a one-time card scoped to the approved purchase; it does not support recurring payments in this preview. Those controls help govern the product action. Leadership still owns the surrounding business process.
Before connecting an agent to a wallet or financial account, forward these seven rules to Finance, Operations, and the system owner.
1. Separate the financial actions
Do not approve “financial access” as one undifferentiated capability. List the exact verbs the workflow may perform: read a balance, draft an invoice, send a payment link, change a price, prepare a refund, issue a refund, select a product, place an order, or release a payment.
Each verb can carry a different risk, owner, evidence requirement, and approval limit. Reading an unpaid-invoice list is not the same as sending a customer a payment request. Drafting a refund is not the same as executing one. Ordering a $40 team lunch is not the same as creating a recurring software obligation.
The first control is a simple authority map: action, accountable owner, permitted agent role, required approval, and retained evidence. If the business cannot fill in those five fields, it is not ready to expand the action.
2. Approve a defined transaction
“Buy lunch” is an intent, not a complete transaction specification. Before approval, the user should be able to see the supplier, item or service, quantity, delivery destination, currency, total including expected fees and taxes, and maximum approved amount.
The company should also decide which changes require a fresh approval. A different restaurant, substituted item, larger quantity, added delivery fee, or higher final amount may be harmless—or material. The important point is to define the boundary before the exception occurs.
This preserves the value of human approval. A person is deciding on a concrete transaction rather than approving a vague objective and discovering the final terms later.
3. Apply company purchasing policy
A product can ask for approval without knowing every internal rule that should shape the answer.
The business still needs to define permitted categories, budget ownership, approved suppliers, spending thresholds, segregation of duties, exception handling, and any documentation required before a purchase. If the workflow cannot reliably enforce a necessary restriction, keep an authorized human step in the process.
This is not a criticism of the agent. It is the same discipline required when a new employee, card, procurement portal, or vendor is introduced. The product controls the action it was designed to control. The company controls whether that action belongs inside its operating model.
4. Map every wallet and connector separately
Similar-looking connections can grant very different powers. Link pays for purchases. The separate Stripe connector works inside a Stripe account and can support other administrative actions. Connecting one does not mean the other is connected, and the permission model for one should not be copied onto the other.
For every wallet or connector, record:
- which account and legal entity it belongs to;
- which data the agent can read;
- which actions it can prepare or complete;
- who can change or disconnect access; and
- where the provider records approvals and outcomes.
Repeat this review when capabilities or connected accounts change. “We approved the AI tool” is not a durable substitute for knowing what each integration can do today.
5. Name the receipt and record owner
A successful chat response is not a reconciled business transaction.
One purchase may create several records: the agent’s action history, the approval request, a temporary card authorization, a merchant order, a final charge, a delivery confirmation, a receipt, and an internal business record. These objects may appear at different times and in different systems.
Name the person or function responsible for connecting them. That owner should know where the receipt is expected, which evidence establishes that the merchant completed the order, how the final amount reaches the company’s normal recordkeeping process, and who investigates a mismatch.
The agent may reduce the work required to initiate a transaction. It does not make accountability disappear.
6. Reconcile uncertainty before retrying
Agentic workflows create a familiar operational hazard: the interface reports an unclear result, so someone tries again.
That retry can produce a duplicate purchase, refund, invoice, or customer message if the first action actually succeeded. Link’s help guidance notes that a failed purchase can temporarily appear as pending and that a merchant may still decline or block checkout after approval. The correct response to uncertainty is evidence, not repetition.
Define a reconciliation order before the first live transaction: check the agent action record, approval status, wallet authorization, merchant order state, and the company’s system of record. Assign a human owner for unresolved cases. Retry only after the organization can explain what happened to the first attempt.
7. Test the complete business transaction
A demo proves that the agent can perform a step. An operating test proves that the business can govern the transaction from request through evidence and reconciliation.
Use a bounded, low-risk scenario that exercises the full path: permitted request, policy check, approval, successful purchase, receipt capture, final-record handoff, rejection, cancellation where supported, and an ambiguous or failed result. Confirm that the organization can detect the outcome and stop safely before expanding the workflow.
The test should also verify the boundaries. Can access be disconnected? Can the agent act outside the approved amount? What happens when a site blocks automated checkout? Who receives the alert when the action needs review? Which records remain available afterward?
The goal is not to prove that every agentic transaction is dangerous. It is to prove that convenience and control can survive the same real process.
The executive question is larger than lunch
Purchasing lunch makes the shift easy to see, but the management question applies wherever an agent touches commercial activity: invoices, refunds, price changes, customer communications, vendor orders, or any action that can create a financial or contractual consequence.
Ask one question before the next connection goes live:
If the agent completes the action, can we identify who authorized it, which rule permitted it, what evidence proves the outcome, and who owns the next step?
If the answer is scattered across three departments and four systems, the next move is not another connector. It is a business-process decision.
TEEVA Growth OS begins with a Commercial Gap Analysis for eligible companies that need to connect AI-enabled commercial workflows without losing ownership of the underlying decisions, evidence, and operating handoffs. Talk with TEEVA about the workflow you are considering before you expand it.