Intelligent Operations · Workflow design
Agentic Document Intake
Every demo shows a clean PDF and a correct answer. The workflow lives or dies on the invoice that arrives twice, the date that could be March or December, and the field nobody checked.
Key takeaways
- Extraction accuracy is not the bottleneck. Reconciliation against a system of record turns a plausible value into a verified one, and it is the stage most implementations leave out.
- Confidence gates belong on fields, not documents. A document-level score averages the number you cannot afford to get wrong with fifteen you can.
- Duplicate detection is a financial control, not housekeeping. The same invoice arriving through two channels is the most common way an automated pipeline pays twice.
- A document is untrusted input. Text inside it can be written to address your model, which makes intake a security surface as well as an operational one.
- The deliverable is not a filled form. It is a record — values, sources, confidences, checks, decision, approver — that survives a question asked six months later.
The short answer
Build intake as five stages with a field-level confidence gate and an evidence record: receive and fingerprint, classify, extract to a schema, reconcile against a system of record, then post or escalate. Reconciliation is the control — matching values against a purchase order, receipt, contract or vendor master is what separates a verified fact from a confident guess. Escalate the specific field that failed rather than the document, and keep per-field provenance so the decision can be audited later.
Five stages
Naming the stages matters, because each one fails differently and each one needs its own number.
Receive and fingerprint
Take the document in from mail, upload, portal or shared drive, store the original immutably, and hash it. The fingerprint is what makes the pipeline idempotent: the same file arriving twice must not become two payables.
Classify
Decide what the document is before deciding what to read from it. An invoice, a credit note, a statement and a remittance advice all contain amounts, and treating them alike is how a statement becomes a duplicate payment.
Extract to a schema
Pull declared fields into a typed structure with a confidence and a source location per field. Free-form output is not extraction, it is a summary — and a summary cannot be reconciled.
Reconcile against a system of record
Match every field that carries consequence against something authoritative: the purchase order, the goods receipt, the contract, the vendor master, prior invoices.
Post or escalate
Write to the system of record with the evidence attached, or route the specific failed check to a human who owns it.
Where the value actually is
Straight-through rate is decided by stages 04 and 05, not by the model in stage 03. Teams that plateau at a low automation rate almost always have a competent extractor and no reconciliation.
The confidence gate
A single document-level confidence score is close to useless. It averages the field that can cost you money with fifteen that cannot, and it hides the one that mattered.
| Field | Checked against | Tolerance | On failure |
|---|---|---|---|
| Total amount | Purchase order, goods receipt | Exact, or the PO tolerance | Escalate the field |
| Bank account | Vendor master, prior payments | Exact match required | Out-of-band verification |
| Invoice number | Prior invoices from this vendor | Must not already exist | Reject as duplicate |
| Line quantities | Goods receipt | Within receiving tolerance | Escalate the line |
| Dates | Contract term, accounting period | Inside an open period | Escalate if it crosses a close |
| Vendor identity | Vendor master, tax identifier | Exact on the identifier | Hold; never create a vendor |
Scroll the table horizontally on narrow screens.
- Set the threshold per field from the cost of being wrong, not from a global default.
- Escalate the field, not the document. A reviewer who has to re-read twelve pages to fix one date will not stay fast for long.
- Keep the source location — page, and where the format allows it, the region — so verification is one glance rather than a search.
- Never let the model set its own threshold, and never accept a confidence you have not calibrated against your own corrections.
Calibration is local
A confidence value only means something against your own correction history. Until you have compared a few hundred model confidences with what a human then changed, 0.94 is a number, not a probability.
Reconciliation is the control
This is the part an extraction model cannot do for you, because the truth lives in your systems rather than in the document. It is also the part auditors ask about.
- 01Three-way matchInvoice against purchase order against goods receipt. A pass means someone ordered it, someone received it, and the price agrees. The oldest control in accounts payable, and exactly as useful with an agent performing it.
- 02Duplicate detectionMatch on vendor, amount, invoice number and a date window, as well as on the file fingerprint. Duplicates arrive because the same invoice comes by email and by portal, or because a resend has a new file name.
- 03Vendor master checkThe beneficiary must already exist, with those bank details. An agent that can create a vendor is an agent that can pay anyone.
- 04Period and policy checkDoes the date fall in an open period, does the amount sit under the approver’s limit, does the category require a contract reference. Cheap to evaluate, and the source of most legitimate escalations.
The one that costs real money
A changed bank account on a genuine-looking invoice is the most reliably profitable attack on accounts payable, and it works on humans too. Bank detail changes must be verified out of band against a known contact — never against a number printed on the document that requested the change.
None of these controls are new. The point is that agentic intake does not replace them; it runs them on every document instead of on a sample. That, rather than the extraction, is the improvement worth claiming.
Where intake breaks
| Failure | What it looks like | What contains it |
|---|---|---|
| Ambiguous dates | 03/12 read as March or December | Locale declared per vendor, cross-checked against the period |
| Multi-page tables | Line items split across pages, totals double-counted | Reconcile the total against the line sum and against the PO |
| Near-duplicate resends | “Copy of INV-20871.pdf” — same content, new hash | Content-level duplicate keys, not only file hashes |
| Currency confusion | Shared symbols, no currency code on the document | Vendor master currency as default, escalate on mismatch |
| Embedded instructions | Text in the document addressed to the model | Treat document text as data; it must never change tool arguments |
| Poor scans | Confident extraction from an unreadable region | Reject on image quality before extraction, not after |
Scroll the table horizontally on narrow screens.
The fifth row is a security problem rather than an accuracy one. Any pipeline where document text reaches a model that can also call tools inherits the whole indirect prompt injection problem; the mechanics and the defences that hold are in indirect prompt injection explained.
- invoices
- credit notes
- remittance advice
- statements
- purchase orders
- contracts
- expense receipts
- tax documents
What the record must contain
The output of intake is not a populated form. It is an evidence record that survives a question asked six months later, when whoever ran it has forgotten the document entirely.
Intake record — the shape that survives an audit
document sha256:9f2c...a71 received 2026-08-19T08:41Z channel: email
classified invoice conf 0.99
fields total 48,200.00 USD conf 0.97 p1 (region 4)
invoice_no INV-20871 conf 0.99 p1
vendor Northwind Ltd conf 0.98 p1
bank_acct ****4417 conf 0.93 p2 [CHANGED]
checks three_way_match PASS (PO-4402, GR-9911)
duplicate PASS
vendor_master FAIL (bank details differ)
decision escalated: bank_acct -> ap.controller
resolution verified out-of-band, approved 2026-08-19T11:02Z
posted AP entry 88214, evidence attached- Every field carries its value, its confidence and where it came from.
- Every check carries its result and the records it matched against.
- Every escalation carries the field, the reason, the approver and how it was resolved.
- The original document stays immutable and addressable by hash.
Two things fall out of this for free: an auditor gets a defensible trail per document, and you get the data to calibrate your thresholds against real corrections rather than against a vendor’s benchmark.
Metrics that mean something
- ›Extraction accuracy on a benchmark set
- ›Documents processed per hour
- ›Share of documents “touched by AI”
- ›Average confidence score
- ›Straight-through rate: posted with no human touch
- ›Correction rate per field, ranked
- ›Cost per processed document, including review time and retries
- ›Escalation dwell time, median and 95th percentile
- ›Duplicates and mismatches caught per thousand documents
Straight-through rate and correction rate move in opposite directions when a threshold is wrong, which makes them a useful pair to read together. Both rising at once means the gate has been loosened past what the checks can catch.
The denominator to use for cost, and why per-document is not the same as per-outcome, is worked through in cost per outcome. Which of these actions can run unattended at all is autonomous vs human-in-the-loop operations.
The product
Governed intake, reconciliation and durable evidence
BarzelOps runs the intake and approval workflow across the systems the documents belong to, with customer-owned credentials and a durable audit trail. Barzel FinOps Atlas holds the financial evidence graph — transactions, invoices, purchase orders, receipts, approvals, reconciliations — that the matching runs against.
Key terms
- Straight-through processing
- A document that reaches the system of record with no human intervention.
- Field-level confidence
- A confidence value attached to each extracted field rather than to the document as a whole.
- Document fingerprint
- A hash of the received file, used to keep the pipeline idempotent.
- Three-way match
- Agreement between the invoice, the purchase order and the goods receipt.
- Escalation dwell time
- How long an escalated item waits before a human resolves it.
- Evidence record
- The per-document record of values, sources, confidences, checks, decisions and approvals.
Frequently asked questions
What is agentic document intake?
A pipeline in which an agent receives a document, classifies it, extracts declared fields with per-field confidence, reconciles those values against a system of record, and then either posts the result or escalates the specific check that failed.
Is extraction accuracy the main constraint?
No. Reconciliation is. Extraction produces values; matching them against a purchase order, receipt, vendor master or prior invoice is what makes them trustworthy, and that is what sets the straight-through rate.
Should confidence thresholds be per document or per field?
Per field. A document-level score averages the field you cannot afford to be wrong about with the ones you can, and hides the failure that matters.
How do you stop duplicate payments?
Fingerprint the file, and separately match on vendor, amount, invoice number and a date window, so that resends and re-scans with different hashes are still caught.
Can a document attack the agent processing it?
Yes. Text inside a document is untrusted input and can be written to address the model directly. Document content must never be able to change which tool runs, or with what arguments.
Sources and further reading
Primary specifications and standards this article relies on. Where a claim is our own judgement rather than something a standard states, the article says so in the text.
- 01 · U.S. Government Publishing Office Sarbanes-Oxley Act Section 404 ↗ Statutory basis for internal-control-over-financial-reporting evidence.
- 02 · COSO COSO Internal Control — Integrated Framework ↗ The control framework auditors map financial process evidence to.
- 03 · ISO ISO/IEC 27001 — Information security management ↗ The ISMS baseline that agent controls have to fit inside.
- 04 · OWASP GenAI Security Project OWASP GenAI LLM Top 10 (2026) ↗ Current consensus list of LLM application risks, including excessive agency.
- 05 · Simon Willison Prompt injection — ongoing series ↗ The most consistently updated practitioner record of this attack class.
- 06 · CNCF OpenTelemetry ↗ Standard for the traces and spans an agent execution record should emit.
Last reviewed 2 September 2026. External links open in a new tab; we do not control their content.
Reference documentation
Want the specification rather than the argument?
Where intake lands in the evidence graph, and the tools that detect what is missing.
Free · 500 calls/mo · on the MCPize marketplace
Written by
Mark Alex
Founder of Real Biz Digital and architect of the Barzel ecosystem — five MCP servers published and callable in public. Software developer, technology entrepreneur and mechatronics engineer, working across AI agent governance, MCP security, AI infrastructure, FinOps and intelligent operations.