Four Payments Executives Define Where Automation Still Needs Human Approval

Evidence Determines How Much Authority Software Receives

Across agentic payments and merchant acceptance, automation depends on evidence that a system can exercise the discretion it receives. The executives describe authority expanding as organizations become more confident in the information, models and controls supporting a decision.

“For me, autonomy is earned with evidence,” Paymentology Chief Technology Officer Tim Joslyn told PYMNTS.

Joslyn described shadow mode as one way to establish that record. An agent receives the information available to an employee and records what it would decide without executing the action. Comparing those proposals with decisions and outcomes gives the company a basis for considering permissions.

Those permissions could apply to specified actions, amounts, counterparties and conditions. A company would expand the mandate after assessing performance within the assignment.

Maverick Payments Senior Vice President of Risk and Underwriting Bill Christensen described a related progression in merchant reviews. Maverick uses AI to automatically onboard accounts with predictable profiles and low risk. Applications with conflicting information or unfamiliar business practices go to underwriters.

Christensen expects predictable accounts to receive automated handling over the next two or three years. Cases considered borderline today could become routine as information improves and models and controls mature.

His conditions for broader automation include the ability to interpret risk in context and explain a conclusion. That places the quality of a decision alongside the organization’s ability to understand how it was reached.

The two accounts suggest that delegation proceeds through demonstrated competence within an assigned remit. For payment agents, the evidence comes from comparing proposed actions with acceptable outcomes. For merchant acceptance, it includes better information and assessment of business practices.

In both settings, the expansion of authority requires a company to evaluate what the system has demonstrated before assigning it decisions that previously required an employee’s approval and accepting the consequences of that delegation.

Transaction Context Determines Which Decisions Reach People

The transactions that reach employees share characteristics that processing cannot resolve within established permissions. Payment size, unfamiliar destinations and conflicting information all influence whether an automated workflow refers a decision for review.

Emily Nash-Walker, senior director of product strategy at Tungsten Automation, described payments to established suppliers as candidates for processing within defined tolerances. Rent and utilities provide familiar activity around which companies can establish controls.

A large payment or a supplier in a country where the business does not ordinarily transact deserves further examination. Nash-Walker cited $100,000, $250,000 and $1 million disbursements as examples where a chief financial officer might want someone to examine why funds are leaving the company.

“I really don’t envision [a time] where we’re going to have auto-approvals on everything,” she told PYMNTS.

At i2c, Vice President of Fraud Risk Management and Dispute Operations Matt Pearce identified exceptions involving account releases, credit increases and compliance restrictions. Releasing an account flagged for complex fraud activity requires an assessment of the exposure created by departing from existing controls. A credit increase beyond predefined limits requires authority beyond the automated system’s remit.

Merchant reviews add another reason for referral. Christensen described businesses that share a merchant category code yet differ in their operations and delivery of services. Underwriters need to understand how each accepts payments and where losses could arise before deciding whether approval conditions address the exposure.

These examples give exception handling an operational meaning. A transaction reaches a person because its circumstances require an assessment outside the authority already assigned to software.

The remaining review work consequently concentrates on decisions that demand information, judgment or permission beyond ordinary processing. Companies determine which characteristics trigger that referral, while employees assess whether the transaction or account is acceptable under the circumstances and what conditions should govern its approval.

Automation Requires Controls Across the Decision Process

An automated approval draws on several functions that have to operate together. The executives describe systems that combine transaction assessment, operating rules, monitoring and records, with people responsible for determining how those components work.

Pearce considers a single agent with unrestricted authority across the process unlikely. His description of a decision framework combines AI models, fixed rules, real-time risk scoring, behavioral analytics and continuous monitoring under an institution’s policies and tolerance for risk.

An agent could approve a routine dispute while a flagged pattern refers the case to a person. Employees would design controls, establish policies and monitor outcomes as their work moves from operating decisions toward supervising automated activity.

Nash-Walker described a need to preserve oversight throughout accounts payable. Traceability, reporting and designated stops maintain records for audits, tax reviews and other examinations without requiring an employee to inspect every disbursement.

She also expects agents to assume work now assigned to rules engines. For an enterprise operating across all 50 states, an agent could adjust for a requirement in one jurisdiction without developers revising a larger collection of rules.

“We’re going to move away from rules engines specifically, and we’re going to move more toward agents that are auditable and traceable,” she said.

Paymentology’s discussion adds the instruction record to those operating requirements. Joslyn described models capturing user intent, the parameters supplied to an agent and restrictions on its authority. Those records help establish whether an authenticated agent acted within its mandate.

The combined observations extend the work of automation beyond generating an approval. Organizations need to preserve the information used to authorize an action, apply the controls and examine performance.

Human supervision under that arrangement concerns the operation of the decision process. Employees maintain the policies and records that allow activity to be examined after money has moved.

Accountability Survives the Removal of Individual Approvals

Delegating an approval leaves a separate operational question for the institution using the system: whether it understands the outcome well enough to explain and support it. Executives across the interviews placed responsibility with the organization relying on the automated decision.

“You can automate a decision, but you can’t automate away accountability,” Christensen said.

For Maverick’s underwriting executive, vendors, model builders and the people setting rules have responsibilities, while the operating company must understand the system’s parameters and stand behind its decisions. That includes mistakes made within an automated process.

Nash-Walker placed responsibility with the person responsible for signing off on a transaction, while noting that the responsible party and applicable requirements differ across jurisdictions. Her account leaves enterprises with responsibility for determining how their approval arrangements satisfy those obligations.

Pearce likewise said a financial institution remains accountable to customers and regulators. Technology providers, model developers and platform partners contribute to decisions, while vendors retain responsibility for the integrity of their technology.

Paymentology’s Joslyn identified uncertainty over liability when an agent makes a payment it should not have made. The programmer and the person issuing the instruction occupy different positions in that sequence, and he said a clear liability model has yet to emerge.

That uncertainty affects the willingness to delegate consequential actions. Pearce expects human involvement in these consequential exceptions to continue for at least three to five years, particularly in fraud, compliance, credit risk and customer disputes.

His estimate concerns those exceptions rather than every authorization or account action. The eventual removal of a reviewer depends on the institution’s confidence in the result and its willingness to accept responsibility for it.

“Once institutions are confident they can explain, govern and then stand behind the automated decision, that final button, that final human in the loop could disappear,” he said.