Agents & authority

Payvy is built for agents and people to share one workflow. Every action is a command, served the same way over REST and MCP from one registry — so there is no API path an agent can’t see and no UI path that bypasses the rules. See Commands: REST & MCP.

The tiers

• Agent keys can read bills, enter them, file documents, signal events, and propose workflows and payees. They prepare the work and assemble the evidence.
• Person-only commands — approve, reject, release a payment, void, accept/decline a workflow or a payee — refuse agent keys at the server. Agents don’t see them in tools/list at all; this is enforcement, not a hidden button.
• Confirmed tier (release, mark paid, void): preview → single-use token bound to exactly what was previewed → commit. A preview runs the real command and rolls back, so what you confirm is what happens.

Changing where a vendor is paid is the classic AP fraud, so payees follow the same shape: anyone, agents included, can propose a payee; only a person can accept one, and the event log records what it replaced.

When an agent gets stuck

The work should pause with a clear reason, the supporting evidence, and a person responsible for the decision. Tasks are designed to survive disconnects and restarts, and payment handling investigates an uncertain bank outcome before retrying — with the same idempotency key, never a fresh one that could pay twice.

Planned

Fine-grained per-agent permissions, task-scoped assignments and spending policies are planned. The current boundary is actor type (agent vs. person), enforced per command. The product direction is documented on payvy.com/agent-controls.