The Invoice Approval Is the Agent's Permission Slip

An accounts payable team approves an invoice in BILL. The supplier, the amount and the due date are fixed, and two people have signed off. The payment is decided.

So why does somebody still have to log into the supplier's website and type in a card number?

The easy answer is that nobody built the integration. That's partly true, but the supplier's portal is designed to keep software out. A page that accepts card numbers is a page fraudsters use to test stolen cards, so it sits behind a CAPTCHA and a login, and it can't tell a legitimate payment bot from a malicious one.

On October 20, Visa, BILL and Billtrust launched a pilot that removes that last step. BILL's payment agent pays approved invoices through Billtrust supplier portals, and the portal lets it in without a CAPTCHA or a shared password. It works because B2B payments already solved the hard part of agent authorization, a problem consumer commerce is still stuck on.

The last step is a login page

Checks were 81% of B2B payments in 2004. By 2025, according to the AFP's payments survey, they were 26%, with ACH credits and checks still the two dominant methods. Card payments are a smaller slice, and they're the slice that often still runs through a supplier's portal, which is where automation stalls.

According to Visa's FAQ, the final payment step "often requires an employee to manually log into a supplier portal and submit payment information." BILL's Archana Prasad called portals "friction points, requiring a person to manually complete what should be an automated step."

The workaround until now has been shared credentials. A buyer's AP clerk holds a login for each supplier's portal, and an automation tool that wants to do the clerk's job needs that same login. Visa says the pilot "is designed to eliminate the need to share supplier-portal logins."

On the paying side, BILL says nearly 500,000 businesses use it and that it processes about 1% of US GDP each year. Billtrust's network on the receiving side reaches more than 20 million buyers and $1 trillion in annual trade credit, according to the company.

What the portal checks

Visa's Trusted Agent Protocol, or TAP, gives the portal a way to recognize an agent it has never seen before. The agent signs each request with a private key. The portal reads a key ID from the request header, fetches the matching public key from Visa's key store, and verifies the signature.

The Oct 13 piece on how the card networks split covered TAP's design. On the merchant side, Visa's specification tells the site to block the request if any required field is missing, if the signature's creation and expiry times are more than 8 minutes apart, or if the same nonce shows up twice within 8 minutes. If the public key can't be retrieved or has expired, the request is blocked too.

A delivery driver at an office building's front desk works the same way. The receptionist doesn't know the driver, but recognizes the uniform and the company badge, and trusts the company to have vetted its own staff. Visa's spec makes the same move, saying a valid Visa key "would imply the Agent's participation in (and compliance with) Visa Intelligent Commerce program requirements."

The receptionist still has no way to check what's in the package or who ordered it, because the badge only identifies the driver's employer.

TAP also wasn't designed for this pairing. The spec describes agents acting for "Consumers" at "Merchants," and says it's intended for "the scenario when the Agent is initially unknown to the Merchant." A buyer and a supplier with an ongoing billing relationship could integrate directly. The pilot borrows a consumer protocol to avoid building one portal integration per supplier.

The permission slip

The Oct 13 piece left one problem open, which is that TAP proves which agent is transacting but leaves spending limits to the merchant and the issuer. In consumer commerce that gap is the whole difficulty, because what the cardholder told the agent ("find me the cheapest flight") lives outside the protocol.

Accounts payable writes the intent down before any agent is involved. An invoice names a payee and an amount, and an approval workflow records who agreed to pay it. Visa's FAQ asks the question directly, "Is the AI agent making payment decisions?" Its answer is no, the agent "only executes eligible payments that have already been approved by the buyer."

A school field trip runs on the same split. The parent signs the permission slip at home, days earlier, and the museum guard at the door only checks that the slip is signed and the kid matches the name. Nobody at the museum asks the child whether they really want to go.

In the pilot, BILL plays the parent. It holds the approval and issues "tokenized payment credentials and controls aligned with the buyer's approved payment instructions," on what Visa calls "a purpose-built payment path tied to the specific invoice," so by the time the agent reaches Billtrust's portal, the only question left is whether its signature checks out.

I can't tell you exactly what "approved payment instructions" means inside BILL. None of the three companies' releases define it, whether it's a per-invoice approval, a policy that auto-approves certain vendors, or both. The thesis holds either way, but how much authority the agent really has depends on that answer.

What's actually new

Agents typing payments into supplier portals isn't new. Ramp announced its Agents for AP in October 2025, and its release says the agents "find card payment opportunities directly in the vendor's payment portal, eliminating manual entry and capturing cashback."

The change in this pilot is on the portal's side, which now recognizes the agent by its signature. Billtrust's side of the pilot uses TAP to "recognize, authenticate, and grant access to the authorized agent," which Visa says "can satisfy the site protections historically provided by CAPTCHA and other bot blocking mechanisms, without requiring an additional agent login."

Big banks are taking the opposite approach to the same unknown-agent problem. On JPMorgan's October 13 earnings call, Jamie Dimon said the bank won't "allow just any … outside agent to come in inside the company," adding, "You don't want rogue agents, and it could be thousands of them." TAP is Visa's bet that a vetted list of agents can replace a locked door.

Visa's October 20 release called this the "first live pilot" of its kind, and its October 21 release says the agents "initiate and help complete" payments, wording that leaves room for a person or another system to finish some of them. The pilot is live and processing transactions, but none of the companies has disclosed how many.

Where the risk went

If a fraudster impersonates a vendor and the invoice gets approved, the agent pays it faithfully, on the due date, with no one pausing at the portal. Because the approval is already there, the fraud risk sits upstream in the AP workflow, where it always was, and the portal step that used to slow it down is gone.

Visa is building a fix, but it lags the automation. Visa Commercial Supplier Validation "helps verify payments are sent to the intended supplier," and it's in pilot until general availability in 2027. And according to Worldpay, "No liability shift exists yet" for agent transactions.

The supplier also pays for the convenience. Billtrust puts average card acceptance costs around 2.5% per transaction. On a $40,000 invoice, paying by card instead of ACH costs the supplier about $1,000, while the buyer's side collects the cashback Ramp's release advertises.

Visa's release says the pilot lets BILL pay by card to suppliers "that historically supported automated payments primarily through ACH or check." That's why Billtrust frames portal payments as happening "in accordance with their acceptance policy." Automating the card payment makes it easier to send, and the supplier's policy is the remaining limit on how often it arrives.

For twenty years, the clerk typing card numbers into supplier portals was also, accidentally, the last person who might notice an invoice looked wrong. With the typing automated, that check now depends on the approval workflow and, starting in 2027, on Visa's supplier validation.