The problem. Before paying a vendor invoice, AP teams match it to a purchase order and a goods receipt. When the numbers differ, someone pulls the documents, works out what happened and writes down why. It is slow, and the reasoning is rarely recorded. Automation usually stops at "numbers don't match". What it does: Deterministic rules check every invoice against its PO and goods receipt and flag exceptions. Clear cases, like an exact duplicate, go straight to review. An investigation agent takes the ambiguous cases. It retrieves the records through tools, checks policy and PO amendments, and submits a structured finding with a recommendation (approve, request vendor clarification, escalate or reject) and a confidence level. A review dashboard shows the evidence side by side with the agent's reasoning. The reviewer accepts the recommendation or overrides it, with a reason. An insert-only audit trail records every rule check, tool call, status change and decision, including which Vultr model produced each finding. The key idea: explanation is not authorization. Why you can trust it. The controls are enforced in code, not in the prompt: The "verified facts" are built by the backend from the retrieved records and its own arithmetic. The model's text is shown only as interpretation. The agent can retrieve only its own invoice and PO, and cannot submit a finding until the required lookups have run. approve is blocked when an invoice overbills with no covering amendment, even if the model is told to approve. A failed investigation falls back to human review rather than guessing. The recorded reviewer is the authenticated user, not a typed name. Vultr usage: One Vultr cloud VM runs the app with Docker Compose and automatic HTTPS. Vultr Serverless Inference (deepseek-v4.1-flash-1017) powers the tool-calling investigation loop. OpenRouter is a fallback only for transient failures; configuration and authentication errors fail loudly.
Category tags: