The New Vendor Trap: Why AI Procurement Agents Need a Pending-Status Gate

Category: Procurement & Supply Chain | Reading time: 5 min

---

The Risk That Multiplies at Scale

Manual procurement teams naturally slow down for new vendors. There's friction — the AP team notices an unfamiliar name, asks someone to verify, checks references. This friction, annoying as it is, provides a de facto safety gate.

AI procurement agents eliminate that friction. Which is mostly a good thing — until it isn't.

An AI agent that can process 1,000 invoices per day doesn't slow down for unfamiliar vendors. It applies the same process to every invoice, every time. If the process doesn't include a new vendor gate, new vendors get paid on the same automated track as established ones. And new vendors are where procurement fraud concentrates.

According to the Association of Certified Fraud Examiners, billing fraud schemes — fictitious vendors, shell company payments, duplicate invoices from new suppliers — account for 24% of all occupational fraud cases, with a median loss of $100,000 per case.

Your AI needs a new vendor gate. Here's how to build it.

---

The Pending-Status Pattern

The most effective approach is to give every vendor a status field with three values:

• approved — vetted and cleared for payment; standard policy applies
• pending — new or recently added; requires procurement approval regardless of payment amount
• blocked — OFAC-sanctioned, fraud-flagged, or contractually excluded; hard deny

The key insight is that pending triggers approval routing independent of the payment amount. A $50 invoice from a new vendor requires the same procurement sign-off as a $50,000 one. The amount is irrelevant — the vendor's status is the gate.

---

The Rego Rule

package taos.procurement.vendor_payment

# New vendor gate — amount-independent
new_vendor_approval_gate {
    input.vendor_status == "pending"
    input.is_ofac_cleared == true
}

action = "require_approval" { new_vendor_approval_gate }
required_role = "procurement_manager" { new_vendor_approval_gate }
rule_fired = "new_vendor_approval_gate" { new_vendor_approval_gate }

This rule fires before any amount-based tier is evaluated. A pending vendor with a $500 invoice gets the same treatment as a pending vendor with a $50,000 invoice — both route to procurement manager approval.

The procurement manager reviews the vendor's details, checks references, completes the vendor onboarding checklist, and either approves or denies. If approved, the vendor status is updated to approved in the vendor database. If denied, the invoice is held and the submitter is notified.

---

The Onboarding Checklist as Policy Pre-Condition

A more sophisticated implementation makes specific vendor verification checks conditions for the pending → approved transition:

# Vendor is ready for first payment only if onboarding is complete
new_vendor_first_payment {
    input.vendor_status == "pending"
    input.vendor_onboarding_complete == false
}

# Vendor completed onboarding but hasn't been formally approved yet
new_vendor_awaiting_approval {
    input.vendor_status == "pending"
    input.vendor_onboarding_complete == true
    input.vendor_manager_approved == false
}

action = "deny"             { new_vendor_first_payment }
action = "require_approval" { new_vendor_awaiting_approval }
required_role = "procurement_manager" { new_vendor_awaiting_approval }

Under this policy:

1. Invoice from new vendor arrives
2. Onboarding status checked via input.vendor_onboarding_complete
3. If onboarding incomplete → hard deny (invoice held until onboarding done)
4. If onboarding complete but not yet approved → approval request to procurement manager
5. Manager approves → vendor status updated to approved, invoice processed
6. All subsequent invoices from this vendor flow through normal amount-based tiers

---

Fraud Signal Integration

The pending-status gate becomes significantly more powerful when connected to fraud signal sources. Before the policy evaluation, the kernel can check:

• TIN/VAT matching — does the vendor's tax ID match the business name in government registries?
• Address verification — is the vendor address a residential address, a PO box, or a known registered agent farm?
• Bank account age — was the vendor's bank account opened within the last 30 days?
• Duplicate detection — does this vendor share an address or bank account with another vendor?

These checks become additional input attributes:

deny_suspicious_new_vendor {
    input.vendor_status == "pending"
    input.tin_match == false
}

deny_suspicious_new_vendor {
    input.vendor_status == "pending"
    input.bank_account_age_days < 30
}

action = "deny" { deny_suspicious_new_vendor }

Suspicious signals trigger a hard deny rather than a routing to approval — the invoice is held for investigation, not just reviewed.

---

The Business Process Behind the Gate

The new vendor gate works best when paired with a clear business process:

1. Invoice arrives from unknown vendor AP team receives invoice. AI extracts vendor details and looks up status in vendor master.

2. Vendor not found → auto-create with pending status The AI creates a vendor record with pending status and queues the vendor for onboarding.

3. Onboarding request sent to vendor Procurement team contacts vendor for W-9/W-8, bank details, business registration, reference contacts.

4. Onboarding complete → approval request created When onboarding data is received and validated, the approval request goes to the procurement manager.

5. Manager approves → status updated, invoice processed Vendor becomes approved. Original invoice is processed. All future invoices flow normally.

This process doesn't slow procurement — it sequences it properly. The AI handles steps 1 and 2 in seconds. The onboarding process runs in parallel. The first payment is only held until onboarding and approval complete.

---

The Bottom Line

New vendor fraud is the most common entry point for billing fraud schemes. An AI procurement agent without a new vendor gate is the most efficient possible tool for facilitating such schemes.

The pending-status gate costs almost nothing to implement — one Rego rule, one policy update, one approval routing configuration. It provides a systematic, auditable, consistently-applied check for every new vendor relationship.

Build the gate before you deploy the agent.

---

Tags: procurement fraud, new vendor approval, AI procurement, vendor onboarding, policy-as-code, billing fraud prevention