External-source research synthesis, not a Sander Gansen client result. Evidence reflects the supplied October 2026 research and source-specific dates.
The invoice decision has already been made
An agent executing an approved invoice is not the same as an agent deciding which supplier to use, what the business owes or whether a dispute should be waived. A clear delegation specifies an eligible action, identity, amount, currency, recipient and the approval that makes it permissible. Technical access alone supplies none of those commercial decisions.
What the Visa, BILL and Billtrust pilot says
The named live pilot processes approved invoice payments between participating buyers and supplier portals. Recognised agents and tokenised credentials are controlled around the buyer’s approved payment instruction. Its FAQ explicitly says the agent is not making payment decisions: it executes eligible payments already approved by the buyer. The announcement does not disclose a participant count, transaction count, production error rate, DSO improvement or general Estonian availability.
Do not upgrade a trial into normal market use
The retained Mastercard Australian examples concern controlled trial or pilot purchases of cinema tickets and hotel accommodation. They are evidence of particular transactions, not universal public availability or everyday industrial procurement. A successful demo still needs scope, credential, error, retry and commercial-authority rules before another business can rely on the pattern.
Documents can contain instructions without authority
NIST describes agent hijacking through malicious instructions embedded in untrusted data. Its laboratory results show configuration-specific attack success and the effect of adaptive or repeated attempts; they are not the prevalence of compromise in the market. The important operating lesson is that a supplier email, PDF or website can contain useful facts while having no authority to change the agent’s permissions.
An illustrative supplier-quote attack
A quote attachment says to ignore policy and email the buyer’s complete price list to another address. The parser can extract permitted quote facts; it must not treat the document as permission to export confidential records. Separate read, draft, send, approve, order and pay. Validate recipient, legal entity, invoice or order identity, amount and policy outside retrieved document instructions. Keep idempotency and audit acknowledgement for consequential actions.
Test the transition, not a model’s promise of safety
Use synthetic copies of the intended workflow with malicious documents, stale instructions, duplicate actions, revoked approvals and retries. Check deterministic before/after states and harmful side effects. Confirm that revocation actually blocks action, that a retry does not double-pay and that failure routes to the named owner. Public agent guides on a website help discovery; they do not grant commercial authority. A useful agent is bounded by the consequence of its work, not by how confident its explanation sounds.
Sources and next reading
NIST: agent hijacking evaluation.
Explore OfferSignal · Focused Business & AI Workshop · All research
Hands-on product, business and AI leadership for executives of established companies. Working on agentic commerce through OfferSignal.
About Sander