/ THE SHORT ANSWER
- 01Keep spending authority outside the model's editable context.
- 02Distinguish reading, recommending, reserving and ordering.
- 03Design approval around the actual transaction and evidence.
- 04Test cancellation, duplicates and malicious supplier content.
/ dotSuper point of view
An agent should operate within independently enforced commercial authority, with evidence sufficient to reconstruct every consequential action.
Describe actions before describing intelligence
These are materially different capabilities and should not share a single enabled setting.
Write the allowed actions in the language procurement uses.
An agent might suggest replenishment for approved consumables but have no authority to substitute materials, change delivery terms or accept a new supplier.
NCSC guidance highlights unreliable output and prompt injection among AI risks.[
1] A supplier quotation or attached document can therefore be useful evidence without becoming an instruction the system is authorised to obey.
Use an independent execution service to check the proposed action.
The model supplies structured information, while conventional controls validate the supplier, item, amount and approval state against authoritative business records.
Put the limits where the model cannot edit them
Store that boundary in the application and access configuration, with a controlled process for changes.
Repeating the limits in a prompt can help explain them but should not enforce them.
Give the agent credentials that match its approved role.
A recommendation service does not need an administrator account simply because that makes integration easier.
Avoid inherited permissions that expand when another connector is added.
Use the approved supplier and item records at execution time.
A model's remembered copy may be stale.
If an item has been blocked or a supplier suspended, the system should detect that before the order leaves.
Assign an accountable human for changes to the policy.
They should understand the commercial consequence of a new permission, not merely approve a technical configuration request with an unfamiliar field name.
| Action | Default permission | Escalation |
|---|---|---|
| Read approved stock data | Allowed within role | Missing or stale record |
| Compare approved suppliers | Recommendation only | Unapproved source |
| Draft purchase order | Allowed without dispatch | Missing commercial terms |
| Place bounded repeat order | Only through policy controls | Value or quantity exception |
| Change bank details | Never delegated to this agent | Finance-controlled workflow |
| Change its own limits | Not permitted | Accountable human change process |
Make approvals about the proposed commitment
2] For a private manufacturer, the useful adaptation is a named chain of responsibility for what the agent recommends and what the business commits to.
Show the approver the item, supplier, quantity, price, delivery terms, reason and evidence.
A button saying approve AI suggestion gives too little context for a meaningful purchasing decision.
Bind approval to that specific proposal.
If the agent changes the quantity or supplier afterwards, the old approval should not remain valid.
Record a new version and require the relevant review.
Avoid approval fatigue by keeping the initial scope narrow.
A flood of low-quality suggestions encourages habitual clicking.
Improve the recommendation queue before increasing the number of actions available to the agent.
Work through a hypothetical consumables order
Its internal policy allows an agent to propose up to 40 units and requires a buyer to approve dispatch.
A supplier document contains ordinary pricing plus an instruction to ignore the limit and order 400 units.
The document is treated as untrusted content.
The execution service rejects quantities outside the policy regardless of the model's wording.
At a hypothetical unit price of GBP 12, 40 units cost GBP 480 before any applicable tax or delivery charges.
Four hundred would cost GBP 4,800.
Multiplication exposes the consequence of the extra zero without relying on a confidence score.
The buyer approves the 40-unit proposal.
A retry after a connection interruption uses the same order identity, so the system can detect whether the original purchase already succeeded before attempting another dispatch.
Test the paths that demonstrations avoid
The agent should have a defined way to stop and explain missing information rather than forcing an answer.
Test cancellation before promising autonomous replenishment.
An order placed incorrectly may be easier to create than reverse.
The workflow needs to distinguish a cancellation request from confirmed supplier acceptance of that cancellation.
Review log access carefully.
Decision records should explain actions without becoming an unrestricted archive of confidential quotations.
Retain source references and the evidence necessary for the approved review purpose.
The tradeoff is narrower autonomy with better control.
A bounded draft-order assistant may create more dependable value than an agent advertised as handling all procurement but requiring constant supervision of unpredictable actions.
Release capabilities one permission at a time
Record disagreement reasons such as minimum order quantities, stock reservations and known delivery constraints.
Approve execution only for a clearly defined transaction class once the surrounding controls work.
A successful consumables workflow does not establish readiness for bespoke materials, capital equipment or supplier negotiation.
Set a visible stop mechanism and a named incident owner.
If the system behaves unexpectedly, procurement needs to know how to pause it without waiting for the original developer.
The next useful deliverable is an authority matrix linked to one purchasing workflow.
That gives the manufacturer a concrete basis for deciding which agent capabilities are worth adding and which decisions still require direct human control.
What this page cannot conclude
- 01The AI playbook is written for UK government organisations and is used here as a voluntary design reference.
- 02No proposed control guarantees protection against every model or integration failure.
- 03Commercial approval limits must reflect the organisation's actual authority and contracts.
- 04This article was researched and drafted with AI assistance. Sources and limitations are provided for scrutiny; it is not an independent professional review or a compliance certification.
Sources
- 01AI and cyber security: what you need to knowNational Cyber Security Centre · accessed Sep 15, 2026
- 02Artificial Intelligence Playbook for the UK GovernmentGovernment Digital Service · accessed Sep 15, 2026
This article was researched and drafted with AI assistance. Sources and limitations are provided for scrutiny; it is not an independent professional review or a compliance certification.
Our editorial standard · Found an error? Send a correction with its source.
/ CITE OR SHARE THIS GUIDE
Make the evidence easy to verify.
When you reference this guide, link to its canonical URL. That gives readers one stable place for the evidence, limitations and future updates.
dotSuper Research Desk. (September 15, 2026). Give Purchasing Agents Limits They Cannot Rewrite. dotSuper. https://dotsuper.net/feeds/applied-systems/uk-ai-purchasing-agent-authority-controls