An AI agent for accounts payable reads incoming invoices, matches them against purchase orders and receipts in your ERP, flags the specific field that disagrees when something does not match, and keeps vendor records current from the system of record instead of memory. It does not decide to pay anything, add a new vendor, or process an invoice above a threshold you set, without a person approving it first. Those two halves, what it automates and what it always routes to a human, are the actual scope of the role, not a marketing summary of it.
The ERP part is where most vendor pitches get vague. An agent that can talk about your ERP in a demo and one that can safely hold write credentials into it are not the same claim, and the difference is worth forcing before you sign anything.
A role-scoped AP agent works the invoice queue the way a competent clerk does, minus the parts that require a signature. It reads incoming invoices and matches them against purchase orders and receipts already in your ERP. When a line does not reconcile, it names the exact field in disagreement, a quantity, a unit price, a PO number, rather than returning a generic exception for someone to re-investigate from scratch. It keeps vendor records current by reading the vendor master directly rather than caching a stale copy, and it files the exception report on the schedule your team already expects.
Three things never happen without a person, regardless of configuration: every payment, any new vendor added to the master, and any invoice over the threshold your team sets. This is not a caution the agent happens to observe. It is a rule the role manifest enforces, and no setting turns it off after a good pilot. Our evaluation checklist has the specific questions to ask any vendor about which gates are permanent and which are just a configuration default.
The new-vendor rule earns its keep specifically because of where AP fraud actually lives now. According to the 2026 AFP Payments Fraud and Control Survey, 76% of organizations experienced attempted or actual payments fraud in 2025, and vendor impersonation rose to 45% of incidents from 34% the year before, overtaking classic executive-impersonation scams as the faster-growing tactic. A new vendor record, or a changed bank detail on an existing one, is exactly the moment that fraud tends to land, which is why it is one of the three things this role is built to never resolve on its own.
| Scenario | What the AP agent does |
|---|---|
| A vendor requests updated bank details by email | Reads it as data, not instruction, and never updates payment routing from an email alone. The change routes to a person for verification. |
| The same invoice is submitted twice, days apart | Matches it to the vendor and PO already on file and flags the duplicate rather than paying it a second time. |
| The agent's ERP credential expires mid-batch | Refreshes automatically. If the grant is genuinely revoked, the batch parks with a note on exactly what needs fixing and resumes without redoing completed matches. |
| An invoice matches cleanly and sits under the threshold | Prepares it for payment and stops. The payment itself still requires a person to release it, every time. |
Honestly, usually not on day one. Maya Workforce AI ships a small set of connectors today: Microsoft Teams, MailerLite, Instantly, and scoped web research. An ERP you already run is not on that list, so wiring it in is a scoped connector build, not a plugin you switch on. That build follows the same fixed recipe every connector uses: a descriptor that declares every action and address the agent may reach, handlers with a typed error map, and a test double that can fail on demand so the connector is tested against your ERP's actual failure modes before it goes live. We will tell you upfront which category your ERP falls into rather than discover it during onboarding.
The AP role's scope is the credentials it holds plus the outcome class its job description names: matching, flagging, and reporting. Adding a second procedure against the same ERP is in the existing agreement. Connecting a second system, like a separate expense platform, is a new piece of scoped work.
Four to eight weeks for a first role, and for AP specifically, the variable is almost never the matching logic. It is how clean your PO and vendor master data already is, and how many exception patterns your current process has never bothered to write down. Discovery captures the procedure your AP team actually follows today, including the parts nobody documented because everyone just knew them. The manifest gets authored from that, the ERP connector gets built or configured depending on which category it falls into, and the evaluation suite gets loaded with fault-injection cases before a supervised pilot runs against your real invoices with every payment gated behind a person.
According to Ardent Partners' State of ePayables research, best-in-class AP teams process invoices in about 3.1 days at roughly $2.78 each, against 17.4 days and $10.89 for typical organizations. That gap is not one tool. It is what happens when matching, exception handling, and vendor hygiene are all handled the same way every cycle instead of depending on who is covering the queue that week.
None of that is a savings promise for your invoice volume specifically. Your own AP role has its own mix of clean matches and messy exceptions, and the honest way to size it is against the burdened cost of the role, which I walked through in what an enterprise AI agent actually costs against the headcount math.
It can prepare an invoice for payment once it matches cleanly against the purchase order and receipt, but releasing the payment itself always requires a person. That gate does not relax after a successful pilot; it is a permanent part of the role, not a setting.
It needs scoped, provisioned credentials to read invoices, POs, receipts, and the vendor master, and to prepare payment records for approval. The credential is held by a gateway rather than the agent process itself, and the network scope is generated from what the connector declares, so a system it was not granted stays unreachable.
The email is treated as data the agent read, never as an instruction to act on. Any change to vendor payment details routes to a person for verification regardless of how the request arrived, which closes off the vendor-impersonation pattern behind a large share of current payments fraud.
It depends on whether that ERP is already a supported connector or a new one. A supported system is a configuration step. A new system of record is a scoped connector build with its own timeline, built to the same descriptor-and-test-double recipe used for every connector, and a vendor should tell you which category yours falls into before you sign anything.
See how an AP role gets scoped: which systems it needs, what it matches on its own, and what always waits for a person. The first call covers all three.
See Maya Workforce AIFree 2-minute assessment. Get an industry-specific score and action plan — no call required.