GOVERNED WORKFLOW PILOT
A proposed 10-business-day, sandbox-only pilot for supplier bank-detail changes. We map the client’s actual process, assign decision rights, test failure paths, and compare the evidence trail with the current workflow.
Scribe’s current product page describes automatic workflow capture, exception context, and MCP/API access for AI tools. DREADNOUGHT tests the adjacent control problem: what evidence an agent must assemble, who may decide, and what forces the agent to stop.
The page reports 94% Fortune 500 reach, 90,000 enterprises, and 50% better agent output based on a customer survey and MCP benchmark.
These are Scribe’s statements. This page does not independently verify adoption or performance claims.Review Scribe’s pageFBI IC3 describes business email compromise involving vendor impersonation and changed payment instructions. Its guidance recommends verifying changes through a known contact channel.
This supports the choice of a high-risk workflow. It does not validate this proposed design or prove comparative performance.Read FBI IC3 guidanceThese requests combine legitimate business administration with a known impersonation and payment-diversion risk. The reference flow below starts the discovery discussion; the client’s process owner must confirm or correct each step before testing.
The agent drafts a case with the supplier, requested change, source messages, and supporting records.
It checks required fields and surfaces mismatches, urgency, unfamiliar contacts, or missing evidence.
The supplier owner confirms the change through a known number already on file. A number supplied in the request does not qualify.
An AP approver accepts or rejects. A separate authorized operator updates the record under the client’s policy.
Discovery will identify actual role holders and approved systems. This proposed division of authority sets the pilot’s starting boundary.
The agent never contacts the supplier, changes bank records, releases payment, infers approval, or overrides client policy.
We first map the real process with the workflow owner, AP control owner, and security contact. Then we run sanitized examples in a sandbox and review the evidence together. The pilot does not touch production payment systems.
Compare results with a client-approved baseline. No fraud reduction, time savings, or superiority claim appears until the pilot measures it.
Stop the test if a control fails, an unauthorized action occurs, or a decision cannot be reconstructed from the evidence.
The next step requires a process owner, an AP control owner, sanitized examples, and agreement on the test boundary. The engagement begins only after the workflow and access rules receive client approval.