Expenses · Policy checks
WorkflowTravel and expenseChecking every expense against the written policy, and citing the clause
Managers approve expense reports in a hurry and finance finds the problems at audit. These notes cover a workflow that reads each expense against the written policy and tells the manager which clause it may break, without rejecting anything itself.
Valnora & Elric team5 min read
Most companies have a travel and expense policy that runs to a dozen pages and a manager who approves a report in 40 seconds between meetings. Finance finds the problems later: a hotel well over the city cap, a team dinner billed as client entertainment, a receipt that never arrived. By then the money is paid and the conversation is awkward.
These notes cover a single workflow in Agent Serve that reads each new expense against the written policy and tells the approving manager which clause it may break, before they approve. It never rejects anything itself.
What does the workflow actually check?
From a submitted expense to a cited flag
Workflow · Policy check
- 01Every two hoursA Schedule trigger lists expense reports submitted since the last run.
- 02SAP Concur or BrexExpense lines, receipts, merchant, category, amount, attendees and trip.
- 03Policy rulesPlain-language checks for limits, receipts, alcohol, class of travel and timing.
- 04Written policyThe travel and expense policy, searched for the exact clause behind each flag.
People · Decision
- 05Expense checks tableOne row per checked line: pass or flag, the rule, the clause and the evidence.
- 06Manager decidesGets the flag in Slack, Teams or email and approves, queries or sends back in the expense tool.
The checks fall into two groups.
- Rules with a number. Nightly hotel caps by city, meal limits per head, a receipt for anything above a set amount, economy class on flights under a set length, submission within 30 days of the expense. These are written in Rules as plain-language checks, so a finance lead can read "Hotel nightly rate is at or below the cap for the city in the limits table" and change the cap without opening the workflow.
- Rules that need reading. Is alcohol on a meal with no client present? Does the business purpose match the trip? Is a taxi on a weekend linked to travel? An agent block reads the expense, the receipt text and the attendee list, and answers each question with pass, flag or not applicable.
For every flag, the agent searches the policy in a Knowledge Base and quotes the clause number and its words. A flag without a clause is not sent; it is written to the table for finance to review, because it usually means the policy does not cover the case.
Where do the expenses come from?
From SAP Concur or Brex, through their blocks in the workflow builder. A Schedule trigger runs every two hours in working time and lists expense reports submitted since the last run. For SAP Concur, it reads each report and its lines; for Brex, it lists expenses and their receipts. Receipts that arrive as images are read with a document parsing block so the agent can compare the receipt total with the claimed amount.
Each checked line is written to an expense checks table in Tables: report, employee, line, result, rule, clause and a short reason. Lines that pass are recorded too, which makes the monthly flag rate a simple count.
What does the manager receive?
What the solution produces
Flag sent to the approving manager (illustrative)
MessageExpense report ER-5521 · Priya N. · Client visit, Singapore, 14 to 16 Sept
Line 3 · Hotel · 3 nights at 410 SGD a night. Policy clause 4.2 sets a nightly cap of 300 SGD for Singapore unless a client or event venue requires the hotel. No reason entered.
Line 7 · Team dinner · 186 SGD for 2 attendees. Clause 6.1 sets 60 SGD a head for internal meals. Attendee list shows one client, so the client entertainment limit in clause 6.3 may apply instead.
Lines 1, 2, 4, 5 and 6 passed all checks.
Nothing has been rejected. Approve, ask Priya for a reason, or send the report back in SAP Concur.
One message per report, not one per line, sent to the approving manager in Slack, Teams or by email. It lists the flagged lines with the amount, the clause and what would make it acceptable, then says how many lines passed. It ends with what the manager can do in the expense tool: approve, ask the employee, or send the report back.
The tone matters. Early drafts that said "violation" got pushback from managers who knew the context. "Policy clause 4.2 sets a cap of..." works better, because it states the rule and leaves the judgement with them.
Why is nothing rejected automatically?
Because the exceptions are where policy meets real life. A client books the hotel. A flight is cancelled and the rebooking is in business class. A city's cap was set three years ago. A workflow that sends those reports back creates rework and resentment, and teaches people to work around it.
So the workflow only reads and notifies. It does not approve, reject, recall or comment on a report in SAP Concur or Brex. The manager makes the decision in the tool they already use, and that tool keeps the record of who approved what.
How do you keep the flags useful?
Watch the flag rate per rule, not just overall. A rule that flags a third of all hotel nights is probably measuring an outdated cap, not bad behaviour. A small dashboard over the expense checks table shows flags by rule, by team and by month, and how many flagged lines managers approved anyway. When managers approve almost every flag from one rule, review the rule with the policy owner.
Two other practices help:
- Version the policy. When finance updates the policy, upload the new version to the Knowledge Base and retire the old one, so clauses cited are always current.
- Test before you deploy. Workflows run from a deployed version. Run a changed rule against last month's expenses first and compare the flags with what finance would have expected.
What about privacy?
Expense data carries names, locations and sometimes health or family details in a business purpose. PII redaction can mask personal data in logs and block outputs, and row-level access keeps each manager's view of the checks table to their own reports.
Controls and governance
Run logs
Every workflow run records each block’s inputs, outputs and errors, so a reviewer can trace how a result was reached.
Audit trail
Proposals, approvals, declines and executed actions are written to the workspace audit log, which admins can export.
Deployed versions
Workflows run from a deployed version, so a change is reviewed before it reaches production runs.
Roles and permission groups
Admin, write and read roles per workspace, plus permission groups that limit which models, blocks and integrations a team can use.
Row-level access
Row-level policies narrow what each person sees in tables, dashboards, exports and scheduled reports.
PII detection
A Guardrails block detects personal data and blocks or masks it before text reaches the next step.
More on how Agent Serve handles access, data and audit on the security page.
Start with one team and the five rules that cause the most rework at audit, then add more once managers trust the flags. For the payables side of finance operations, see AP invoice intake.
Questions teams ask
Why not let the workflow send reports back automatically?
Policies have exceptions that only a person can judge: a client chose the hotel, a flight was rebooked after a cancellation. The workflow points out the clause, and the manager decides. That keeps a person accountable for every rejection.
Does it replace the audit rules in the expense tool?
No. Keep the hard limits the expense tool already enforces at submission. These checks cover the parts of the policy that need reading, such as attendee rules, business purpose and timing, and they cite the written clause.
What you need
- SAP Concur or Brex connected, with access to read submitted expenses and receipts
- The current travel and expense policy as a document, with numbered clauses
- Per-city or per-country limits for hotels and meals, if your policy has them
- A manager for every employee, from the expense tool or your HR system
- A Slack or Teams channel, or an email route, for manager notifications
- A finance owner who reviews the rules and the flag rate each month