On November 9, Hitachi began offering a service called TWX-21 Procurement AI. There is one sentence in the official description that I stared at for a long time: the product can organize supplier replies, identify high-risk orders, and draft follow-up messages, which are sent after staff review.
The five-character phrase “check before sending” is the most weighty part of the entire announcement. It acknowledges one thing—AI can finish 90% of the work, but the act of sending must be done by a person. And this is precisely the step purchasing officers are least willing to let go of, because once the message is sent, the supplier’s price, delivery date, and commitments are set.
On the same day, another document made this point even more forcefully. Deutsche Bank and Ant Digital Technologies jointly released a white paper, "Agentic Payments in Wholesale Finance," discussing Agent payments in institutional treasury, cross-border payments, and trade finance. The framework it presents has only three parts: intent and orchestration, control and authorization, and settlement. The Agent operates in the middle part, while the boundaries at both ends are governed by deterministic rules.
Looking at these two things together, the real issue for enterprise AI in November 2026 has already changed. It is no longer "what an agent can do," but "at what point it must stop." That point where it stops is where the signature goes.
1. What enterprises buy is not capability, but the design authority over approval points
Over the past two years, vendors have sold AI by piling on capabilities: it can search, write, edit, and send. The list grew longer and longer, and procurement departments grew more and more excited. But after it actually went live, almost none of the problems were about capabilities; they were about boundaries.
The Hitachi case offers a very practical way to break this down. It divides procurement actions into several segments: quote comparison (read), order issuance (write), delivery management (tracking)—and then only in the "follow-up information" segment does it let AI generate drafts, which must be reviewed by a human before sending. This design is not flashy, but it meets the least resistance during implementation, because no one is forced to hand over the action they care about most.
Deutsche Bank's report is a bit more technical. It requires Agent identity to be verifiable, authorization to be explicit and revocable, and decision-making to be separated from execution. The word 'revocable' is very important—it does not mean 'once you authorize it, it stays valid forever,' but that it can be withdrawn at any time. This is the same idea as creating a three-month account for a temporary worker in ERP: permissions have a time limit; they are not granted once and valid for life.
Anyone doing ERP implementation has probably seen a cautionary tale in Odoo: to make a process "go through," some automated action is written as sudo(), which amounts to bypassing all record rules (ir.rule). The system keeps running and the logs keep recording, but who owns that record and whether he should be able to see it all become invalid. Once agents are brought in, this kind of shortcut will be amplified tenfold—because it can run thousands of times a day.
There is an even more hidden problem: many enterprises think they have a confirmation mechanism, but in fact they only have a countersigning mechanism. A payment order has five people attached behind it; it looks rigorous, but in reality the first four are all waiting for the fifth to review it first, and the fifth is accustomed to just clicking approve. This kind of chain could barely operate in the manual era because the volume was small and someone could catch errors; once an Agent multiplies the document volume tenfold, everyone on the chain becomes a rubber stamp.
A genuine confirmation key must meet three conditions: understandable, dare to veto, documented. A document you cannot understand does not count as a review; an approval you dare not veto does not count as oversight; a pass with no audit trail is as good as never having happened. If any one of these three is missing, adding a signature is just process decoration.
II. Users are more clear-headed than manufacturers
On November 9, Pogo released a survey of 502 Walmart shoppers, with all samples verified through receipts or bank card transactions from the past 90 days. It asked about the same capability, using two authorization methods:
79.1%
If the AI places orders directly according to product and budget rules without requiring approval for each order, the proportion not accepting any product category
About 57%
Proportion willing to authorize at least one category if AI first fills the shopping cart and the person reviews it before placing the order
The capability didn't change, the model didn't change; only one confirmation step was added, and acceptance flipped from “almost everyone refused” to “more than half were willing to try.” This is a consumer scenario, but the psychological structure of enterprise procurement is exactly the same. What really puts people off is not “AI buying for me” but “AI buying on my behalf.”
So solutions that tout "fully automated" as a selling point are actually harder to sell in procurement, payment, and release. It's not that business departments don't believe in the technology; they just don't want an order they haven't reviewed tied to their name.
III. Regulators and companies' internal teams use the same yardstick
The Office of the Comptroller of the Currency (OCC) released a Super Intelligence supervisory examination framework on November 4 for examiners to assess banks' related applications. The document explicitly states that it does not introduce new supervisory expectations or mandatory requirements, but provides an observational lens: assess risk based on potential consequences, degree of delegation, and human oversight, and adjust control intensity accordingly.
Looking at these three items separately, they actually form a scoring rubric that can be directly transplanted into a company's internal operations:
| Judgment dimension | What to ask | Land in ERP |
|---|---|---|
| Potential consequences | What happens if I make a mistake? Can it be undone? | Query vs posting vs payment — orders of magnitude apart |
| Degree of delegation | How much decision-making authority was given | Single document recommendation vs. whole batch release |
| Manual supervision | At which step people intervene, and whether they can understand it | Prior approval, post-event spot checks, or just looking at logs |
A quick reminder, by the way. On November 6, BMO introduced AI Agent Assist for internal customer service, helping with credit card transaction inquiries from Canadian customers by handling transaction matching, policy retrieval, and request preparation, with employees reviewing before making service decisions. Its stated goals are to reduce the handling time for eligible inquiries by 20%–30% and to automatically handle about 40% of eligible refund requests. These are goals, not achieved results—the announcement makes that clear.
In the second half of 2026, I saw too many proposals that mixed "target values" and "measured values" on the same page. The former is the rationale for project approval; only the latter is the basis for acceptance. During review, just asking one more question—"Was this number actually produced, or is it what you plan to reach?"—can save half a year of back-and-forth wrangling later.
IV. Business teams modify the Agent themselves, but must pass three gates
Midas, released by Delight.ai on November 9, took another path. It allows business teams to propose process adjustments in natural language; the system generates operational guidelines and then tests them using simulated customer conversations. It sounds like configuration authority has been delegated, but the key lies later: new versions must pass through plan approval, testing, and go-live approval by authorized personnel as three gates, and are rolled out in phases.
This structure is all too familiar to anyone who works with ERP—development, testing, and production environments, plus change approval. It shows one thing: the AI era has not eliminated engineering discipline; it has only shifted who proposes requirements from IT to the business. The closer the business is to the customer, the more suitable it is to propose changes; but whether a change can go to production still requires someone to sign off.
Think about it the other way: those platforms that advertise "business users edit directly, changes take effect instantly" are precisely the ones that skip these three gates. The time saved by skipping them usually comes back tenfold in troubleshooting costs after the first accidental mis-edit.
V. Confirmation Key Checklist for CIOs
Rather than arguing about "whether to have human in the loop," it would be better to categorize the actions and write clearly, one by one, who presses that button. The version I use in my project is roughly like this:
| Action Type | Reversibility | Who can press the confirm key | What evidence to keep |
|---|---|---|---|
| Query, summarize, compare, draft | Reversible | Agent autonomy | Call Records and Data Sources |
| Change master data, change price, change delivery date | Can be withdrawn but has a broad impact | Module Owner | Value before change, value after change, basis |
| Order issuance, reconciliation, and invoicing | Partially reversible | Business Supervisor + Financial Review | Original documents, approval chain, amount verification |
| Payment, release, letter issuance, and posting | Irreversible | Person to person, do not let the Agent write. | Identity, time, approver, and replayable entire process |
- List "irreversible" separately.Payment, release, letter issuance, posting, and record deletion—these five categories must always be handled person-to-person. Grade the rest by reversibility; don't make a blanket statement that "everything must be human-reviewed," because that is the same as no one reviewing.
- Authorization must be revocable. All accounts, API keys, and temporary privilege escalations used by Agents must have expiration dates and revocation paths. An authorization that cannot be incorporated into the revocation process is equivalent to permanent authorization.
- Evidence chains are enabled by default. For any document involving AI, record when it is stored in the database which interfaces were called, which fields were read, and who gave the final approval. Conclusions without an evidence chain do not enter the approval workflow.
Go back to Hitachi's line, "sent after inspection by staff." It sounds conservative, but it is exactly the kind of conservatism that can scale. With a transaction network of 87,000 enterprises right there, as long as enterprises are willing to let their buyers keep that final step, this service can be driven forward.
The place where companies should really focus their effort is not making AI more daring to act, but drawing clearly enough the boundaries they are willing to let go of. Once the boundaries are clear, more people will dare to use it. This rule is more stable than any generation of models.
Sources: Hitachi TWX-21 Procurement AI release (2026-11-09), Deutsche Bank × Ant Digital Technologies "Agentic Payments in Wholesale Finance" (11-09), Delight.ai Customer Agent and Midas release (11-09), Pogo consumer authorization survey (11-09, sample of 502 people), OCC Super Intelligence examination framework (11-04), BMO AI Agent Assist introduction (11-06). The efficiency and ratios announced by vendors are based on self-testing or target metrics and have not been independently verified by a third party.
Zodioo Information (Zodioo) · Enterprise Digitalization Observation · 2026-11-10
