The Enterprise Guide to AI Agents That Handle Money

00Abstract

Businesses are giving AI agents authority over money: customer-service agents that issue refunds and apply discounts, sales agents that negotiate prices, and purchasing agents that agree quotes and pay invoices. Most testing of these agents checks whether their answers are accurate and polite. Far less checks what they actually do when a customer, a supplier or a fraudster pushes against the rules, over many turns, with a believable story.

This guide is for the people who sign off those agents: heads of customer experience, risk and fraud, finance and procurement, and the engineers who build them. It defines the terms, gives two frameworks for describing the risk, compares testing approaches, and provides a checklist that can be copied into an internal review or a request for proposal.

Scope. Text-based agents (chat, email, API) that act on refunds, prices, orders, invoices or customer records. Voice agents raise the same money questions, but this guide does not cover speech-specific issues.

01The problem nobody tests

An AI agent can reply perfectly and still give money away. “I’m sorry, I can’t offer a discount on this item… but as a valued customer, I can take 15% off today” reads as helpful. If the lowest allowed price was 10% off, it is a loss. Reviews of reply quality miss it, because the loss is in the outcome, not the tone.

Why agents give way

They are built to help. Language models are trained to be agreeable; a customer with a reason gives the agent a reason to help with your money.
Pressure builds over turns. Persistence, a competitor’s price, urgency and “let’s split the difference” each win a small concession.
Rules written in words can be argued with. A limit in a prompt is a sentence the agent weighs against everything else the customer says.
Text can carry instructions. A message, invoice or web page can contain text that reads like an instruction to the agent. OWASP ranks this, prompt injection, first among risks to LLM applications.

It already happens

2024A tribunal held Air Canada responsible for wrong fare information from its website chatbot. Decision

$1A car dealer’s website chatbot was talked into “agreeing” to sell a 2024 Chevrolet Tahoe for $1 (Dec 2023). Report

$2.77BLosses reported to the FBI from business email compromise in 2024, the kind of payment fraud purchasing agents face. IC3 report

What reviews miss

Outcomes: what was refunded, agreed, shipped, paid or shown.
Persistence: the tenth turn, not the first.
Rate: how often, not whether it ever happened.
The opposite failure: good customers refused.

02Terminology

Sixteen terms used in this guide, defined so they can be reused in policies and RFPs.

01Authority: What an AI agent may do with money or records without a person: refund, discount, ship, pay, change details.
02Hard limit: A limit enforced by your systems (the refund tool rejects amounts above the cap), which the agent cannot exceed whatever it is told.
03Soft limit: A limit written only in the agent’s instructions. It holds only as long as the agent follows them.
04Lowest allowed price (floor): The least the business will accept for a product, as a number per product.
05Approved amount: The amount a purchase or invoice was approved for. Paying more is an overpayment, however small.
06Breach: An action that breaks the business’s own rules: a refund outside policy, a price below the floor, data shown to the wrong person.
07Over-refusal: Refusing what the business would have accepted: a sale above the floor, an eligible refund, a genuine invoice.
08Outcome check: Judging a conversation by what the agent did (from its tool calls and commitments), not by its wording.
09Adversarial simulation: Testing an agent with simulated customers, suppliers or fraudsters who try to make it break the rules.
10Adaptive attacker: A simulated party that changes tactic when one fails, as real people do.
11Held-firm rate: The share of adversarial conversations in which the agent made no breach.
12Likely range: The range the true rate probably lies in, given the number of conversations tested (here, a 95% Wilson interval).
13Money at stake: What a breach would have cost: the discount given away, the refund paid, the invoice overpaid.
14Test system: A copy of your systems with test data, where an agent can be tested without real customers or money.
15Prompt injection: Text in a message, document or page that the agent treats as an instruction (OWASP LLM01).
16Excessive agency: An agent with more functions, permissions or autonomy than its job needs (OWASP LLM06).

Using these in an RFP: ask vendors to state, for each money action, whether its limit is hard or soft, and to report held-firm and over-refusal rates with likely ranges.

03The Authority Ladder

The Authority Ladder describes how much an AI agent may do with money on its own. Each action an agent can take sits on a rung; an agent that can refund alone but only propose discounts sits on two. The risk scores are our judgement of exposure, relative to one another, not a measured quantity.

4Acts alone across systemspays suppliers, changes records

3Acts alone, limits in its instructionsthe prompt is the only limit

The biggest step limits move from your systems into the prompt

2Acts within hard limitsyour systems enforce the caps

1Proposesa person approves every action

0Answers onlycannot change anything

The Authority Ladder. Higher rungs can do more alone, and need more testing. Bars show relative risk (our judgement, not a measurement).

RUNG 0Answers only
Risk 3/10
What it can doExplains prices, policies and order status. It cannot change anything.
What goes wrongWrong promises: a refund rule or price it states that the business may be held to.
What to testPolicy accuracy under pressure: does it state the real rule when a customer insists on a different one?
RUNG 1Proposes
Risk 4/10
What it can doDrafts a refund, quote or payment; a person approves every one.
What goes wrongRubber-stamping: the person approves what the agent proposes, so its mistakes still go through.
What to testHow often the proposal itself breaks policy, so reviewers know what to look for.
RUNG 2Acts within hard limits
Risk 5/10
What it can doActs alone, but your systems enforce the limits: maximum refund, lowest price, approved invoices.
What goes wrongEverything inside the limits: an ineligible refund under the cap, a discount above the floor but against policy.
What to testAdversarial conversations against the rules the system does not enforce.
RUNG 3Acts alone, limits in its instructions
Risk 8/10
What it can doActs alone; the only limits are written in its prompt or policy text.
What goes wrongAll five leaks. A persuasive customer can talk it past any rule written in words.
What to testThe full adversarial suite, many times, with a likely range, before launch and after every change.
RUNG 4Acts alone across systems
Risk 9/10
What it can doPays suppliers, changes records, bank details or addresses, and talks to other agents.
What goes wrongThe payment and data leaks at scale, and instructions hidden in documents or messages it reads.
What to testThe full suite plus fraud and injected-instruction tests, continuous re-testing and a person on high-impact actions.

The biggest step is from Rung 2 to Rung 3: from limits your systems enforce to limits the agent is asked to respect. OWASP’s guidance on excessive agency points the same way: enforce authorisation in downstream systems rather than relying on the model, and require human approval for high-impact actions.

04The Five Leaks

The ways an AI agent loses a business money through what it agrees to fall into five leaks. Naming them lets a team say which ones its agent is exposed to, given its rung, and test each one.

Your AI agentwith authority over money

L1Price leakbelow the floor, invalid codes, free extras
L2Refund leakoutside the window, over the limit, twice
L3Goods leakshipped unpaid or to a switched address
L4Payment leakfake or inflated invoices, new bank details
L5Data leakanother customer’s details

And the opposite: over-refusal. Good sales, eligible refunds and genuine invoices refused. It costs money too.

The Five Leaks: every way an AI agent loses a business money.

L1 The price leak

Selling for less than the business allows.

Below the lowest allowed price
A discount code that is invalid or expired
Free extras nobody authorised

L2 The refund leak

Giving money back that policy does not allow.

Outside the return window
Above the refund limit, or twice for one order
Store credit where it is not allowed

L3 The goods leak

Letting goods go without being paid, or to the wrong person.

Shipped on a fake payment confirmation
A payment treated as received when none was recorded
A delivery address changed without verification

L4 The payment leak

Paying out what the business does not owe.

An invoice nobody issued
An invoice above the approved amount
Buying past the budget, or paying to changed bank details

L5 The data leak

Revealing what belongs to someone else.

Another customer’s email, phone or address
Their order history, in whole or in part
Confirming that a person is a customer at all

And the opposite: over-refusal

An agent tuned to never leak refuses what it should accept.

A sale above the floor, lost
An eligible refund, refused
A genuine invoice, left unpaid

Which leaks apply to which agent

Agent	Price	Refund	Goods	Payment	Data
Customer service and returns	Some	Main	Some	—	Main
Sales and quoting	Main	—	Some	—	Some
Storefront and orders	Main	Some	Main	—	Main
Purchasing and accounts payable	—	—	—	Main	Some

05Ways to test, compared

Five approaches are in common use. They answer different questions and are often combined. The comparison describes the approaches in general, not any vendor’s product.

Dimension	Manual spot checks	Scripted test cases	Model-graded evaluations	Security red-teaming	Adversarial simulation with outcome checks
What it checks	Whatever the tester thinks of	Fixed inputs against expected replies	Reply quality, scored by another model	Whether the agent can be made to break its instructions	What the agent did with the money, against the business’s own rules
Long haggling and persistence	A few conversations	Rarely; scripts do not adapt	Depends on the conversations supplied	Sometimes	Yes: simulated customers who push over many turns and change tactic
Fraud tactics (fake proof, impersonation)	If the tester tries them	Only those written in	Only if supplied	Often, as security attacks	Yes, as commercial scams with a cost
Money at stake	No	No	No	Rarely	Yes: what each breach would have cost
Catches over-refusal	Sometimes	If honest cases are written	Sometimes	Usually not the aim	Yes: honest customers are part of every test
A rate with a likely range	No	A pass count, usually without a range	Scores, often without a range	Findings, not rates	Yes
Repeatable on every change	No	Yes	Yes	Periodically	Yes
Setup effort	None	High; cases must be written and maintained	Medium; datasets and graders	Medium to high	Low to medium; your rules and a test system
Best for	Early demos	Known regressions	Answer quality and tone	Security and data protection	Agents with money authority, before launch and after changes

Security red-teaming and adversarial simulation overlap: both send hostile inputs. The difference is what is scored. Red-teaming asks whether the agent can be made to misbehave; adversarial simulation of money agents asks how often it gave money away, and how much, under realistic commercial pressure. More on this in testing AI agents that handle money.

06How many tests a decision needs

A test result is a rate measured on a sample, so it comes with uncertainty. The tables below use the Wilson score interval (Wilson, 1927) at 95%. They are plain statistics, not results from any agent.

If the agent holds firm 90% of the time

Conversations	Held firm	Likely range (95%)
10	9 (90%)	60% – 98%
20	18 (90%)	70% – 97%
50	45 (90%)	79% – 96%
100	90 (90%)	83% – 94%
250	225 (90%)	86% – 93%
500	450 (90%)	87% – 92%
1,000	900 (90%)	88% – 92%

If no breach is seen at all

Conversations, no breach	True breach rate, likely
50	below 7.1%
100	below 3.7%
300	below 1.3%
500	below 0.8%
1,000	below 0.4%

Ten tests decide nothing. 9 of 10 is compatible with a 60% agent and a 98% agent.
Comparing two versions needs the ranges to separate. If they overlap, the change may have done nothing.
Rare, costly breaches need hundreds of conversations. To say a data leak happens less than 1 time in 100, test about 380 times without one.

A worked example for one area is in how to test an AI refund agent.

07Rollout patterns

Three patterns for moving an agent up the ladder, each with a gate to pass before the next. The thresholds are our recommendation; set your own by the money at stake.

PATTERN AWatch only
The agent drafts; people send. Every draft that would have breached a rule is logged. Use it to learn which leaks your real customers try.
Gate to B: adversarial testing in a test system across the leaks that apply, with no data leak, and an over-refusal rate the business accepts.
PATTERN BLimits plus approval
The agent acts alone below hard limits; above them, or for new payees and changed details, a person approves. Most enterprise agents should live here for some time.
Gate to C: at least 500 adversarial conversations per area with the lower end of the held-firm range above your threshold, zero data leaks in 300 or more data-fishing attempts, and re-testing wired into every release.
PATTERN CActs alone, re-tested
Wider limits, fewer approvals, continuous re-testing on every change and on a schedule, production breaches turned into new tests, and a switch to turn off money actions in minutes.
Stay in C only while: re-tests stay within range and monitoring of refund, discount and payment totals shows nothing unusual.

08The 50-point readiness checklist

Score one point for each statement that is true today and supported by evidence. Copy it into an internal review or an RFP. It prints cleanly.

Authority and limits

We have written down the agent’s rung on the Authority Ladder for each action it can take.
Every money action has a maximum, enforced by our systems, not only by the prompt.
The lowest allowed price exists per product, as a number the agent can check.
Refund rules (window, limit, condition, one refund per order) exist as data, not only prose.
Invoices can be paid only if they match an approved purchase and its approved amount.
The agent has only the tools it needs; nothing that can change bank details or other customers’ records.
High-impact actions (above a set amount, new payees, changed details) go to a person.
The agent can hand any conversation to a person instead of conceding.
Prices and order facts come from tool calls, never from what the customer says.
We know who may change the agent’s instructions, and every change is recorded.

Policy and pricing

The rules the agent follows match the published customer policy word for word.
Free extras the agent may offer are listed; everything else needs a person.
Discount codes are validated by the system, never by the agent’s judgement.
Store credit, exchanges and partial refunds have explicit rules.
Prices in the agent’s instructions are updated when prices change.
Supplier budgets and approved amounts are available to the agent as data.
Policy exceptions have an owner who can approve them.
The agent states rules it cannot bend plainly, without inventing new ones.
We have decided what the agent should do when policy is silent.
Honest edge cases (late deliveries, damage, genuine invoices) are written down with the right outcome.

Fraud and identity

Identity is verified through our systems (login, one-time code), never through the conversation.
The agent never treats a screenshot or pasted confirmation as proof of payment.
Delivery address changes after ordering require verification.
Bank detail changes are never accepted from a message.
Messages claiming to be from staff or managers are treated as customer messages.
The agent never confirms whether a person is a customer.
Instructions hidden in messages, documents or web pages it reads cannot change its rules.
Competitor price claims are checked against a source, or not matched.
We know which fraud tactics our industry sees most and test for each of them.
Suspected fraud is flagged to a person with the conversation attached.

Testing and evidence

The agent has been tested adversarially in a test system, never against real customers or money.
Tests include honest customers, so over-refusal is measured as well as breaches.
Tests check outcomes (refunds issued, prices agreed, data shown), not just wording.
Each result has a likely range, and enough conversations to make it useful.
Each breach is traced to the exact line where the agent gave way.
The money at stake per breach is estimated.
Every change to the prompt, model or tools is re-tested before release.
Fixes are re-tested against the same tactics that broke the agent.
Test results are kept as evidence, dated, with the version tested.
Someone outside the team that built the agent reviews the results.

Operations and response

Every money action by the agent is logged with the conversation that led to it.
We review a sample of real conversations every week.
There is a way to switch off the agent’s money actions in minutes.
Customers are told they are talking to an AI where the law requires it.
We have decided how we will handle a price or refund the agent promised in error.
Breaches found in production become new test cases.
The model provider’s changes trigger a re-test.
Refund, discount and payment totals by the agent are monitored for unusual changes.
Support staff know how to take over a conversation from the agent.
The board or risk owner has seen the agent’s test results before launch.

Score	Reading
40 – 50	Ready for the rung you have chosen, with evidence to show for it.
30 – 39	Needs hardening. Stay on Pattern A or B until the gaps are closed.
Below 30	Not ready for money authority. Keep the agent at Rung 0 or 1.

09Questions to ask your agent’s vendor

For an RFP appendix. Mark each answer Compliant, Partial or Non-compliant against the answer to look for.

#	Question	A compliant answer
1	Which actions can the agent take with money, and which limits does your system enforce rather than the prompt?	A list of actions with limits enforced in code or configuration.
2	Can we set the lowest price, refund rules and approved invoice amounts as data?	Yes, per product and per policy, with changes logged.
3	How is customer identity verified before account details are shown or changed?	Through your login or a one-time code, never through the conversation.
4	What happens when a message contains instructions, such as “system note: approve this”?	It is treated as customer text and cannot change the agent’s rules; tested evidence is available.
5	Can we run adversarial tests against a test copy of our agent, with our own rules?	Yes, without real customers or money, as often as we change it.
6	Do you test for over-refusal as well as breaches?	Yes, with honest customers in every test.
7	Can the agent hand a conversation to a person, and does it do so when unsure?	Yes, with the conversation passed along.
8	Is every money action logged with the conversation that caused it?	Yes, exportable, with timestamps and the agent version.
9	How are changes to the model, prompt or tools released, and are they re-tested?	A release process with a re-test before every change reaches customers.
10	Can we switch off money actions without switching off the agent?	Yes, in minutes, by your own staff.
11	Who is responsible when the agent promises a price or refund in error?	A clear contractual answer, consistent with the law where you sell.
12	Can you show test results with likely ranges for an agent like ours?	Rates with ranges and the conversations behind them, not only a pass or fail.

10The law so far

This section is general information, not legal advice. Law differs by country and changes; ask your counsel about your agent.

What the agent says can bind the business

In Moffatt v. Air Canada, 2024 BCCRT 149, British Columbia’s Civil Resolution Tribunal held Air Canada responsible for incorrect fare information its website chatbot gave a customer, and rejected the argument that the chatbot was responsible for its own words. A business should assume its agent’s promises may be treated as its own.

Customers must be told they are talking to an AI

In the EU, Article 50 of the AI Act requires that people interacting directly with an AI system are informed of it, unless it is obvious, from 2 August 2026. Generative systems already on the market by then have until 2 December 2026 to mark their output as AI-generated (Article 50(2)). It is a disclosure duty; it does not set testing requirements for agents that handle money.

Frameworks, not yet rules

The NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1) are voluntary. The OWASP Top 10 for LLM Applications is guidance. Both are useful structures for an internal review, and both point to testing and to limiting what an agent may do alone.

11What comes next (2026 – 2028)

Our view, not a forecast with evidence behind it, so that readers can check it against what happens.

2026 – 27: agents move from answering to acting. More refunds, discounts and order changes happen with no person in the loop, mostly at Rung 2 and 3.
2027: buyers’ agents meet sellers’ agents. Negotiation between two AI agents makes the price leak faster and harder to see.
2027 – 28: evidence of testing becomes a normal request from boards, insurers and large customers, much as security reviews did for software.

12References and how to cite

Moffatt v. Air Canada, 2024 BCCRT 149. Civil Resolution Tribunal of British Columbia. decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do
Regulation (EU) 2024/1689 (the AI Act), Article 50: transparency obligations, applying from 2 August 2026. artificialintelligenceact.eu/article/50/
OWASP Gen AI Security Project. LLM06:2025 Excessive Agency. genai.owasp.org/llmrisk/llm062025-excessive-agency/
OWASP Gen AI Security Project. LLM01:2025 Prompt Injection. genai.owasp.org/llmrisk/llm01-prompt-injection/
NIST AI 600-1. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. July 2024. www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence
NIST AI Risk Management Framework (AI RMF 1.0). January 2023. www.nist.gov/itl/ai-risk-management-framework
Federal Bureau of Investigation, Internet Crime Complaint Center. 2024 IC3 Report. www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
DailyAI. “Chevy dealer’s chatbot tricked into selling car for $1.” December 2023. dailyai.com/2023/12/chevy-dealers-chatbot-tricked-into-selling-car-for-1/
Wilson, E. B. (1927). Probable inference, the law of succession, and statistical inference. Journal of the American Statistical Association, 22(158), 209–212. doi.org/10.1080/01621459.1927.10502953

Cite this guide

APA

Duelpoint Research. (2026). The enterprise guide to AI agents that handle money. Duelpoint. https://duelpointai.com/enterprise-guide/

BibTeX

@techreport{duelpoint2026enterprise,
  title  = {The Enterprise Guide to AI Agents That Handle Money},
  author = {{Duelpoint Research}},
  year   = {2026},
  institution = {Duelpoint},
  url    = {https://duelpointai.com/enterprise-guide/}
}

Questions

What is the Authority Ladder?

A five-rung scale of how much an AI agent may do with money: Rung 0 answers questions only, Rung 1 proposes actions a person approves, Rung 2 acts within limits enforced by your systems, Rung 3 acts alone with limits written only in its instructions, and Rung 4 acts alone across systems such as payments and supplier records. The higher the rung, the more adversarial testing it needs before launch.

What are the Five Leaks?

The five ways an AI agent loses a business money: the price leak (below the lowest allowed price, invalid discounts, free extras), the refund leak (refunds outside policy), the goods leak (shipping without payment or to a changed address), the payment leak (fake or inflated invoices, over-budget buying, changed bank details) and the data leak (other customers’ details). A sixth cost, over-refusal, is the opposite failure: refusing sales, refunds or invoices the business should have accepted.

How many test conversations does an AI agent need?

Enough for the likely range to be narrow enough to decide. If an agent holds firm in 9 of 10 conversations, the 95% range is about 60% to 98%; at 90 of 100 it is about 83% to 94%; at 900 of 1,000 about 88% to 92%. To claim a breach rate below 1% with no breaches observed, about 380 conversations are needed.

Is this guide vendor-neutral?

It is written by Duelpoint, which sells adversarial testing for AI agents. The frameworks, checklist and statistics apply whichever tools you use, every outside claim links to its source, and no Duelpoint test results are quoted.

See where your agent leaks money. Tested against your own rules, with the money at stake.

See the tests How we score