Somewhere this morning, a $3,800 landscaping invoice for a suburban retail center was approved, coded to the right GL account, matched to a purchase order, and queued for payment. Nobody in accounts payable looked at it. Nobody in property management looked at it. An agent did, with a second agent checking its work, and both cleared a confidence threshold someone set in a configuration screen six months ago.

That is not a hypothetical. Yardi's Smart Approval agent, part of Virtuoso, evaluates eligible invoices against learned rules and approves those that qualify; one agent decides, and a second confirms or challenges it. MRI's Agora Orchestrator, launched in June 2026, moves workflows from recommendation to automated execution across commercial, multifamily, and residential portfolios. Both are good products. Both answer a question most property finance teams have not asked yet: when an agent acts, who authorized that?

The wider enterprise is asking it loudly. This week the US Federal Trade Commission opened a broad investigation into frontier-model risk, after a run of incidents in which agents reached systems they were never meant to touch. Fortune reported that the CIOs of Cisco, Intuit, Workday and ServiceNow are building oversight layers around agents, with Cisco's operations chief refusing to authorize any third-party vendor agent at all to avoid "agent sprawl."

The number that should stop a CFO mid-sentence comes from a 2026 survey of 235 large-enterprise security leaders, cited by the Cloud Security Alliance: 71% say AI systems already have access to core ERP, CRM, and financial platforms, and only 16% govern that access effectively. In property management, where the ERP is Yardi or MRI and the "financial platform" is the rent roll, the gap is the same, and the controls are thinner.

This is a playbook for closing it before you switch on native platform agents, not after.

The word "agent" covers a lot of ground, and governance only works if you know which kind you are dealing with. Inside the two dominant property platforms, agents now sit at three levels of autonomy.

Level 1: It answers. Yardi Chat IQ handles prospect and resident conversations across chat, email, text, and voice, grounded in live Voyager data. MRI Agora Intelligence watches the portfolio and recommends actions. These agents read a great deal of data but post nothing to the ledger. The governance risk is disclosure and accuracy, not transactions.

Level 2: It acts within rules. Yardi Smart Approval, paired with Smart AP, captures, codes, and approves invoices that meet amount, vendor, property, and GL criteria you define, using 12 months of your approval history to generate vendor-specific rules. MRI Agora Orchestrator lets teams deploy agents from a pre-built catalog, configure them, and, in MRI's words, let them run. These agents post transactions. They are, functionally, approvers with system access.

Level 3: It builds other agents. Yardi Virtuoso Composer and MRI's agent configuration tools let operators create custom agents without code. A property accountant can now build an agent that reconciles a bank feed, chases tenants, or prepares a month-end journal. Nobody in IT needs to be involved, which is the point- and the problem.

The shift that matters is from Level 1 to Level 2. Once an agent can approve, post, or pay, it has stepped into the control environment that external auditors, lenders, and investors rely on; in most property firms, that environment was designed in the era of named users, wet signatures, and dollar-threshold approval matrices. Agents do not fit it, and the platforms do not retrofit it for you. MRI's own announcement frames Orchestrator as keeping every decision with the person responsible for it; Yardi lets you set amount and confidence thresholds. Both leave the design of that responsibility to you.

Cisco's answer to agent sprawl was to centralize every authorized model, agent and dataset on one internal platform and refuse third-party agents entirely. Few property companies can do that, and most should not. But the reasons Cisco worries apply with more force to a real estate operator than to a software company.

Agents arrive inside the platform, not through IT. A Yardi or MRI release note enables them. A regional controller switches one on for a trial. A marketplace agent gets added to a module during an upgrade. There is no procurement event, no security review, no change ticket. Intuit's CIO describes the resulting risk as agents that get orphaned and become an attack vector when their creator leaves. In property management, where turnover in site and regional accounting roles is high, orphaned agents will be common within a year.

The control environment is shared with third parties. Owners, managers, lenders, joint-venture partners, and outsourced accounting teams all touch the same Yardi or MRI database. An agent enabled by a third-party manager can approve invoices on an owner's property. Whose approval matrix applies? Whose auditor signs off? Management agreements written in 2022 do not say.

Month-end is a chain of dependent steps. Bank reconciliation, accruals, CAM reconciliation, intercompany, investor reporting. An agent that executes one step well can push an error into every step after it, and the error surfaces three weeks later in a distribution calculation. Agents fail fast; property accounting discovers slowly.

The volume case is strongest where the controls are weakest. Yardi reports that 80% of client invoices are under $5,000 and take at least six days to approve. Those are exactly the invoices nobody scrutinizes today, which is why automating them is attractive, and why the fraud and duplicate-payment risk concentrates there.

None of this argues against agents. It argues for treating the day you enable a Level 2 agent as a control-environment change, with the same rigor you would apply to giving a new employee approval authority.

External auditors have not yet published an agent-specific standard for real estate, but the questions are predictable because they are the questions already asked of any automated control. Expect these five in your next audit planning meeting and expect them from lenders and institutional LPs soon after.

The single most useful mental shift is to stop thinking of an agent as a feature and start thinking of it as a new hire. New hires get a role, a manager, a set of system permissions tied to that role, an approval limit, and a review date. Agents should get the same.

A role, not a toggle. In Yardi, create a dedicated security role for each agent rather than letting it inherit the permissions of whoever enabled it. In MRI, do the same with the agent's service identity. The role should allow only the tables, properties, and transaction types the agent needs. The CSA's guidance is that agents should not hold standing access to production systems and should get time-bound, task-scoped credentials where the platform supports it. Few property platforms do yet; where they do not, a narrow dedicated role is the compensating control.

A manager. Every agent needs a named human owner who is accountable for its thresholds, reviews its exception log, and is the first call when it misbehaves. This is normally the controller or AP manager for finance agents and the regional property manager for operational ones. Record the owner in the agent register. When that person leaves, reassign or disable the agent the same day as their user account.

Thresholds that mirror the delegation matrix. Most owners already have a delegation-of-authority matrix: a site manager approves up to $2,500, a regional manager up to $10,000, a VP up to $50,000. An agent's approval limit should be a line in that matrix, approved by the same governance body, not a number typed into a configuration screen. Consider three dimensions, not one:

• Amount per transaction (Yardi's beta clients ran Smart Approval at up to $2,500, a sensible starting point)

• Cumulative amount per vendor per period, which catches split invoices

• Confidence threshold, set conservatively at launch and loosened only on evidence

A review date. Agents learn from history, and their rules drift. Schedule a quarterly review of each Level 2 agent's thresholds, exception rate, and false-approval rate, and minute the results. Treat a change to an agent's limits as a change to the delegation matrix, requiring the same sign-off.

This is unglamorous work. It is also exactly what distinguishes a firm that can show an auditor a control from one that can show them a screenshot.

Segregation of duties is the oldest control in accounting: the person who creates a vendor should not approve its invoices, and the person who approves invoices should not release payments. Agents break this in two easy-to-miss ways.

The agent collapses the chain. Smart AP captures and codes the invoice; Smart Approval approves it; a payment run releases it. If all three are agents configured by the same AP manager, that manager has, in effect, end-to-end control of cash disbursement through a tool that never pushes back. Yardi's two-agent design, where a second agent must confirm the first, is genuine control, but it is a control within the vendor's logic, not within your SoD matrix. Your matrix needs to say which human reviews the agent's exceptions and which human can change its rules, and those should be different people.

The agent inherits a person's conflicts. An agent built in Virtuoso Composer by a property accountant typically runs with that accountant's permission. If the accountant can both post journals and approve them in a small-team configuration, so can the agent, at scale and without the accountant noticing. Agents built on over-privileged human roles are the most common finding in the governance reviews we have seen this year.

The practical fix is a three-column exercise. List every agent. For each, record the duties it performs using the same categories as your human SoD matrix: initiate, approve, record, reconcile, custody. Then overlay the human owners and configurations. Where one person, directly or through agents, touches two conflicting duties for the same transaction stream, you have a finding. Resolve it by splitting the agent's role, moving ownership, or adding a documented compensating review.

Two further SoD points for property firms specifically. First, in a third-party management arrangement, make the owner's finance team, not the manager's, the approver of agent thresholds on owner-funded bank accounts. Second, treat agent rules as privileged access: log them, review them monthly, and keep the ability to change rules away from the people whose work the agent approves.

A log is not evidence until someone can show it answers a question. Property platforms log agent actions, and MRI explicitly positions Orchestrator around the governance and audit trail enterprise operators require. But auditors want more than a list of what happened. They want assurance that the agent does what you say it does, every time, and that its behavior hasn't drifted. Two disciplines borrowed from enterprise automation answer that.

Test automation proves the agent behaves as configured. Treat an agent's rules the way you would treat a Yardi or MRI configuration change: write test cases and run them before go-live and after every platform upgrade. A regression suite built in a tool such as UiPath Test Suite can push a controlled set of invoices through the AP workflow (a duplicate, a split invoice, an over-budget line, a new vendor, an invoice at the threshold, one just above it) and confirm that the agent approves, holds, or escalates each one correctly. The output is a dated, repeatable test report that says: on this date, with these rules, the agent made these decisions. That is control evidence. Re-run it quarterly and after every Yardi or MRI release, and you have a continuous-assurance record instead of a one-time sign-off.

Process mining proves what actually happened in production. Test cases cover what you thought to test. Process mining reads event logs from Yardi, MRI, and surrounding systems and reconstructs how invoices, work orders, or journals actually flowed, including paths nobody designed. It answers the questions auditors and CFOs ask after the fact: What share of invoices did the agent approve versus route to a human? How often did a human override it? Did any approval bypass the purchase-order match? Did the agent's approval rate for a particular vendor jump in a particular month? Those patterns are invisible in a transaction log and obvious in a process map.

Together, the two give you something most firms lack: a before-and-after baseline. Mine the AP process for six months before enabling Smart Approval or an Orchestrator workflow. Record cycle time, touch count, exception rate, and error rate. Enable the agent. Mine again. Now the ROI claim in the board paper is measured, the control claim in the audit file is evidenced, and drift is detectable because you know what normal looked like.

One caution. Both techniques depend on clean, consistent event data from the platform. Firms whose Yardi or MRI instance carries years of inconsistent coding, custom tables, and workarounds often find that the first governance project is data clean-up, not a control design.

Run this before enabling any agent that can approve, post, pay, or change master data. It takes a competent controller and a platform administrator for two to four weeks for a first agent and a few days for each one after.

Before enablement

• Add the agent to the agent register: platform, purpose, owner, enablement date, autonomy level

• Create a dedicated security role with least privilege of access; do not inherit a human user's permissions

• Set amount, cumulative-vendor and confidence thresholds, and add them as a line in the delegation-of-authority matrix with the same sign-off

• Map the agent's duties against the SoD matrix and resolve or document any conflict

• Capture a process-mining baseline of the workflow it will touch

• Build and run a regression test set covering normal, boundary, and adversarial cases

• Confirm where the agent's reasoning and actions are logged, how long logs are retained, and who can read them

• Write the kill-switch procedure: who turns it off, how, and what the manual fallback is for month-end

• Where third-party managers or owners are involved, confirm in writing whose approval matrix governs

First 90 days

• Owner reviews the exception log weekly

• Re-run the regression suite after any platform release

• Compare post-enablement process-mining data to baseline at day 90; report cycle time, override rate and error rate

Ongoing

• Quarterly threshold review, minutes

• Agent reassigned or disabled on the day its owner leaves

• Register and evidence pack presented to the audit committee annually

None of this slows down a well-run deployment. It mostly moves work that would otherwise happen in a panic, three weeks after a distribution went out wrong, to a planned fortnight before go-live.

Agent governance is not a standalone project, and firms that try to run it as one tend to produce a policy document that nobody reads. It works when it is attached to four things most property operators are already doing or planning.

A platform health check. You cannot govern agents on a Yardi or MRI instance you do not fully understand. Most operators running a platform for five or more years carry undocumented customizations, dormant user accounts, over-broad security roles, and workflow exceptions that were "temporary" in 2021. A structured health check of security roles, workflows, configuration, and data quality is the prerequisite: it tells you which human roles are safe to model agent roles on, and which are not.

A Yardi or MRI AI strategy.The platforms are shipping agents faster than any operator can evaluate them. A written AI strategy decides which workflows are candidates for Level 2 automation, in what order, under what thresholds, and what the business case has to show. It is also where the firm decides its posture on third-party and custom agents, the question Cisco answered with an outright ban and most property firms will answer with a tiered approval process.

Test automation. The regression suite described above is the same asset that de-risks every platform upgrade. Firms that have invested in UiPath Test Suite or equivalent for Yardi and MRI releases already have the harness; adding agent test cases is incremental. Firms that have not usually find that the agent project is the business case for building it.

Process mining.The baseline-and-compare method is also how you find the next workflow worth automating, measure the one you just automated, and give the audit committee numbers instead of adjectives. It tends to pay for itself in the AP process alone.

Firms such as Assetsoft, which has implemented, integrated, and supported Yardi and MRI for owners and managers in Canada, the United States, and Australia since 2012 and runs UiPath test-automation and process-mining engagements on those platforms, see the same pattern across clients: governance done before enablement is a two-week task; governance done after the first incident is a two-quarter one. The difference is rarely the technology. It is whether anyone owned the agent register.