Somewhere this morning, a $3,800 landscaping invoice for a suburban retail center was approved, coded to the right GL account, matched to a purchase order, and queued for payment. Nobody in accounts payable looked at it. Nobody in property management looked at it. An agent did, with a second agent checking its work, and both cleared a confidence threshold someone set in a configuration screen six months ago.

That is not a hypothetical. Yardi's Smart Approval agent, part of Virtuoso, evaluates eligible invoices against learned rules and approves those that qualify; one agent decides, and a second confirms or challenges it. MRI's Agora Orchestrator, launched in June 2026, moves workflows from recommendation to automated execution across commercial, multifamily, and residential portfolios. Both are good products. Both answer a question most property finance teams have not asked yet: when an agent acts, who authorized that?

The wider enterprise is asking it loudly. This week the US Federal Trade Commission opened a broad investigation into frontier-model risk, after a run of incidents in which agents reached systems they were never meant to touch. Fortune reported that the CIOs of Cisco, Intuit, Workday and ServiceNow are building oversight layers around agents, with Cisco's operations chief refusing to authorize any third-party vendor agent at all to avoid "agent sprawl."

The number that should stop a CFO mid-sentence comes from a 2026 survey of 235 large-enterprise security leaders, cited by the Cloud Security Alliance: 71% say AI systems already have access to core ERP, CRM, and financial platforms, and only 16% govern that access effectively. In property management, where the ERP is Yardi or MRI and the "financial platform" is the rent roll, the gap is the same, and the controls are thinner.

This is a playbook for closing it before you switch on native platform agents, not after.

The word "agent" covers a lot of ground, and governance only works if you know which kind you are dealing with. Inside the two dominant property platforms, agents now sit at three levels of autonomy.

Level 1: It answers. Yardi Chat IQ handles prospect and resident conversations across chat, email, text, and voice, grounded in live Voyager data. MRI Agora Intelligence watches the portfolio and recommends actions. These agents read a great deal of data but post nothing to the ledger. The governance risk is disclosure and accuracy, not transactions.

Level 2: It acts within rules. Yardi Smart Approval, paired with Smart AP, captures, codes, and approves invoices that meet amount, vendor, property, and GL criteria you define, using 12 months of your approval history to generate vendor-specific rules. MRI Agora Orchestrator lets teams deploy agents from a pre-built catalog, configure them, and, in MRI's words, let them run. These agents post transactions. They are, functionally, approvers with system access.

Level 3: It builds other agents. Yardi Virtuoso Composer and MRI's agent configuration tools let operators create custom agents without code. A property accountant can now build an agent that reconciles a bank feed, chases tenants, or prepares a month-end journal. Nobody in IT needs to be involved, which is the point- and the problem.

The shift that matters is from Level 1 to Level 2. Once an agent can approve, post, or pay, it has stepped into the control environment that external auditors, lenders, and investors rely on; in most property firms, that environment was designed in the era of named users, wet signatures, and dollar-threshold approval matrices. Agents do not fit it, and the platforms do not retrofit it for you. MRI's own announcement frames Orchestrator as keeping every decision with the person responsible for it; Yardi lets you set amount and confidence thresholds. Both leave the design of that responsibility to you.

Cisco's answer to agent sprawl was to centralize every authorized model, agent and dataset on one internal platform and refuse third-party agents entirely. Few property companies can do that, and most should not. But the reasons Cisco worries apply with more force to a real estate operator than to a software company.

Agents arrive inside the platform, not through IT. A Yardi or MRI release note enables them. A regional controller switches one on for a trial. A marketplace agent gets added to a module during an upgrade. There is no procurement event, no security review, no change ticket. Intuit's CIO describes the resulting risk as agents that get orphaned and become an attack vector when their creator leaves. In property management, where turnover in site and regional accounting roles is high, orphaned agents will be common within a year.

The control environment is shared with third parties. Owners, managers, lenders, joint-venture partners, and outsourced accounting teams all touch the same Yardi or MRI database. An agent enabled by a third-party manager can approve invoices on an owner's property. Whose approval matrix applies? Whose auditor signs off? Management agreements written in 2022 do not say.

Month-end is a chain of dependent steps. Bank reconciliation, accruals, CAM reconciliation, intercompany, investor reporting. An agent that executes one step well can push an error into every step after it, and the error surfaces three weeks later in a distribution calculation. Agents fail fast; property accounting discovers slowly.

The volume case is strongest where the controls are weakest. Yardi reports that 80% of client invoices are under $5,000 and take at least six days to approve. Those are exactly the invoices nobody scrutinizes today, which is why automating them is attractive, and why the fraud and duplicate-payment risk concentrates there.

None of this argues against agents. It argues for treating the day you enable a Level 2 agent as a control-environment change, with the same rigor you would apply to giving a new employee approval authority.

External auditors have not yet published an agent-specific standard for real estate, but the questions are predictable because they are the questions already asked of any automated control. Expect these five in your next audit planning meeting and expect them from lenders and institutional LPs soon after.

The single most useful mental shift is to stop thinking of an agent as a feature and start thinking of it as a new hire. New hires get a role, a manager, a set of system permissions tied to that role, an approval limit, and a review date. Agents should get the same.

A role, not a toggle. In Yardi, create a dedicated security role for each agent rather than letting it inherit the permissions of whoever enabled it. In MRI, do the same with the agent's service identity. The role should allow only the tables, properties, and transaction types the agent needs. The CSA's guidance is that agents should not hold standing access to production systems and should get time-bound, task-scoped credentials where the platform supports it. Few property platforms do yet; where they do not, a narrow dedicated role is the compensating control.

A manager. Every agent needs a named human owner who is accountable for its thresholds, reviews its exception log, and is the first call when it misbehaves. This is normally the controller or AP manager for finance agents and the regional property manager for operational ones. Record the owner in the agent register. When that person leaves, reassign or disable the agent the same day as their user account.

Thresholds that mirror the delegation matrix. Most owners already have a delegation-of-authority matrix: a site manager approves up to $2,500, a regional manager up to $10,000, a VP up to $50,000. An agent's approval limit should be a line in that matrix, approved by the same governance body, not a number typed into a configuration screen. Consider three dimensions, not one:

• Amount per transaction (Yardi's beta clients ran Smart Approval at up to $2,500, a sensible starting point)

• Cumulative amount per vendor per period, which catches split invoices

• Confidence threshold, set conservatively at launch and loosened only on evidence

A review date. Agents learn from history, and their rules drift. Schedule a quarterly review of each Level 2 agent's thresholds, exception rate, and false-approval rate, and minute the results. Treat a change to an agent's limits as a change to the delegation matrix, requiring the same sign-off.

This is unglamorous work. It is also exactly what distinguishes a firm that can show an auditor a control from one that can show them a screenshot.

Segregation of duties is the oldest control in accounting: the person who creates a vendor should not approve its invoices, and the person who approves invoices should not release payments. Agents break this in two easy-to-miss ways.

The agent collapses the chain. Smart AP captures and codes the invoice; Smart Approval approves it; a payment run releases it. If all three are agents configured by the same AP manager, that manager has, in effect, end-to-end control of cash disbursement through a tool that never pushes back. Yardi's two-agent design, where a second agent must confirm the first, is genuine control, but it is a control within the vendor's logic, not within your SoD matrix. Your matrix needs to say which human reviews the agent's exceptions and which human can change its rules, and those should be different people.

The agent inherits a person's conflicts. An agent built in Virtuoso Composer by a property accountant typically runs with that accountant's permission. If the accountant can both post journals and approve them in a small-team configuration, so can the agent, at scale and without the accountant noticing. Agents built on over-privileged human roles are the most common finding in the governance reviews we have seen this year.

The practical fix is a three-column exercise. List every agent. For each, record the duties it performs using the same categories as your human SoD matrix: initiate, approve, record, reconcile, custody. Then overlay the human owners and configurations. Where one person, directly or through agents, touches two conflicting duties for the same transaction stream, you have a finding. Resolve it by splitting the agent's role, moving ownership, or adding a documented compensating review.

Two further SoD points for property firms specifically. First, in a third-party management arrangement, make the owner's finance team, not the manager's, the approver of agent thresholds on owner-funded bank accounts. Second, treat agent rules as privileged access: log them, review them monthly, and keep the ability to change rules away from the people whose work the agent approves.

A log is not evidence until someone can show it answers a question. Property platforms log agent actions, and MRI explicitly positions Orchestrator around the governance and audit trail enterprise operators require. But auditors want more than a list of what happened. They want assurance that the agent does what you say it does, every time, and that its behavior hasn't drifted. Two disciplines borrowed from enterprise automation answer that.

Test automation proves the agent behaves as configured. Treat an agent's rules the way you would treat a Yardi or MRI configuration change: write test cases and run them before go-live and after every platform upgrade. A regression suite built in a tool such as UiPath Test Suite can push a controlled set of invoices through the AP workflow (a duplicate, a split invoice, an over-budget line, a new vendor, an invoice at the threshold, one just above it) and confirm that the agent approves, holds, or escalates each one correctly. The output is a dated, repeatable test report that says: on this date, with these rules, the agent made these decisions. That is control evidence. Re-run it quarterly and after every Yardi or MRI release, and you have a continuous-assurance record instead of a one-time sign-off.

Process mining proves what actually happened in production. Test cases cover what you thought to test. Process mining reads event logs from Yardi, MRI, and surrounding systems and reconstructs how invoices, work orders, or journals actually flowed, including paths nobody designed. It answers the questions auditors and CFOs ask after the fact: What share of invoices did the agent approve versus route to a human? How often did a human override it? Did any approval bypass the purchase-order match? Did the agent's approval rate for a particular vendor jump in a particular month? Those patterns are invisible in a transaction log and obvious in a process map.

Together, the two give you something most firms lack: a before-and-after baseline. Mine the AP process for six months before enabling Smart Approval or an Orchestrator workflow. Record cycle time, touch count, exception rate, and error rate. Enable the agent. Mine again. Now the ROI claim in the board paper is measured, the control claim in the audit file is evidenced, and drift is detectable because you know what normal looked like.

One caution. Both techniques depend on clean, consistent event data from the platform. Firms whose Yardi or MRI instance carries years of inconsistent coding, custom tables, and workarounds often find that the first governance project is data clean-up, not a control design.

Run this before enabling any agent that can approve, post, pay, or change master data. It takes a competent controller and a platform administrator for two to four weeks for a first agent and a few days for each one after.

Before enablement

• Add the agent to the agent register: platform, purpose, owner, enablement date, autonomy level

• Create a dedicated security role with least privilege of access; do not inherit a human user's permissions

• Set amount, cumulative-vendor and confidence thresholds, and add them as a line in the delegation-of-authority matrix with the same sign-off

• Map the agent's duties against the SoD matrix and resolve or document any conflict

• Capture a process-mining baseline of the workflow it will touch

• Build and run a regression test set covering normal, boundary, and adversarial cases

• Confirm where the agent's reasoning and actions are logged, how long logs are retained, and who can read them

• Write the kill-switch procedure: who turns it off, how, and what the manual fallback is for month-end

• Where third-party managers or owners are involved, confirm in writing whose approval matrix governs

First 90 days

• Owner reviews the exception log weekly

• Re-run the regression suite after any platform release

• Compare post-enablement process-mining data to baseline at day 90; report cycle time, override rate and error rate

Ongoing

• Quarterly threshold review, minutes

• Agent reassigned or disabled on the day its owner leaves

• Register and evidence pack presented to the audit committee annually

None of this slows down a well-run deployment. It mostly moves work that would otherwise happen in a panic, three weeks after a distribution went out wrong, to a planned fortnight before go-live.

Agent governance is not a standalone project, and firms that try to run it as one tend to produce a policy document that nobody reads. It works when it is attached to four things most property operators are already doing or planning.

A platform health check. You cannot govern agents on a Yardi or MRI instance you do not fully understand. Most operators running a platform for five or more years carry undocumented customizations, dormant user accounts, over-broad security roles, and workflow exceptions that were "temporary" in 2021. A structured health check of security roles, workflows, configuration, and data quality is the prerequisite: it tells you which human roles are safe to model agent roles on, and which are not.

A Yardi or MRI AI strategy.The platforms are shipping agents faster than any operator can evaluate them. A written AI strategy decides which workflows are candidates for Level 2 automation, in what order, under what thresholds, and what the business case has to show. It is also where the firm decides its posture on third-party and custom agents, the question Cisco answered with an outright ban and most property firms will answer with a tiered approval process.

Test automation. The regression suite described above is the same asset that de-risks every platform upgrade. Firms that have invested in UiPath Test Suite or equivalent for Yardi and MRI releases already have the harness; adding agent test cases is incremental. Firms that have not usually find that the agent project is the business case for building it.

Process mining.The baseline-and-compare method is also how you find the next workflow worth automating, measure the one you just automated, and give the audit committee numbers instead of adjectives. It tends to pay for itself in the AP process alone.

Firms such as Assetsoft, which has implemented, integrated, and supported Yardi and MRI for owners and managers in Canada, the United States, and Australia since 2012 and runs UiPath test-automation and process-mining engagements on those platforms, see the same pattern across clients: governance done before enablement is a two-week task; governance done after the first incident is a two-quarter one. The difference is rarely the technology. It is whether anyone owned the agent register.

The first stage of enterprise AI adoption focused largely on experimentation.

Organizations tested AI for activities such as:

• Lease and document abstraction
• Tenant and resident communications
• Invoice processing
• Reporting and analytics
• Data extraction
• Knowledge search
• Maintenance support
• Workflow automation

The next stage is considerably more complex.

Instead of simply generating an answer or summarizing information, emerging AI systems can potentially participate in multi-step business processes, collecting information, identifying exceptions, recommending actions, triggering workflows, and interacting with enterprise applications.

This evolution is often described as agentic AI.

For property management and real estate organizations, that could eventually mean AI supporting workflows across accounting, leasing, maintenance, procurement, reporting, and portfolio operations.

But there is an important catch:

AI can only operate effectively when the systems underneath it are ready.

It can be tempting to treat AI as another application that can simply be added to the technology environment.

In practice, enterprise AI depends heavily on the quality of the infrastructure surrounding it.

Consider a property management organization operating:

Yardi or MRI + CRM + banking platforms + document management + Power BI + construction systems + spreadsheets + custom applications.

If those systems contain inconsistent data, disconnected processes, outdated integrations, and large amounts of manual work, adding AI does not automatically solve the problem.

It may simply add another layer of complexity.

Before organizations scale AI, they should therefore evaluate several foundational areas.

AI systems depend on data.

For real estate organizations, that data may include:

• Properties
• Units
• Tenants and residents
• Leases
• Vendors
• General ledger information
• Work orders
• Invoices
• Bank transactions
• Budgets
• Contracts
• Portfolio performance

If information is duplicated, inconsistent, incomplete, or stored across disconnected systems, AI-generated insights and automated actions can become less reliable.

Organizations preparing for AI should review their data quality, ownership, structure, governance, and accessibility.

This may involve cleaning historical data, standardizing records, improving data migration processes, and establishing clear governance around how information moves between platforms.

For Yardi and MRI environments in particular, the quality of the underlying configuration and data structure can have a major impact on downstream automation and analytics.

Modern real estate technology environments rarely consist of one platform.

Property management systems often need to communicate with banking platforms, CRMs, construction systems, business intelligence tools, procurement applications, document repositories, and specialized PropTech solutions.

AI adds another participant to this ecosystem.

That makes integration architecture increasingly important.

Organizations should understand:

- Where does the data originate?
- Which system is the system of record?
- How does information move between applications?
- Which integrations depend on manual exports?
- Which processes rely on spreadsheets?
- Where are APIs available?

A fragmented integration environment can make AI implementation significantly harder.

A well-designed integration strategy, on the other hand, creates a reliable foundation through which applications, automation platforms, and AI services can securely exchange information.

APIs have already become fundamental to modern PropTech environments.

Their importance increases further as AI becomes embedded into operational workflows.

For example, imagine an AI-enabled process that identifies an accounting exception.

Recognizing the exception is only one part of the workflow.

The system may also need to:

Retrieve data → Analyze transaction → Compare records → Recommend action → Obtain approval → Update enterprise system → Record result

That requires reliable connections between multiple systems.

Real estate organizations should therefore evaluate whether their existing applications and custom integrations can support this level of connectivity.

This is where an API-led integration strategy can help reduce dependency on manual exports and fragile point-to-point connections.

Not every business problem requires artificial intelligence.

In many organizations, significant efficiency gains can still come from traditional workflow automation.

For example:

Invoice received → Validate → Match → Approve → Post

If that workflow is largely manual today, introducing AI without first understanding the underlying process may simply automate an inefficient workflow.

A better approach is to identify:

• Repetitive activities
• Manual handoffs
• Approval bottlenecks
• Duplicate data entry
• Spreadsheet dependencies
• Exception-heavy processes

Organizations can then determine which steps require conventional automation and which genuinely benefit from AI.

This creates a more practical path toward intelligent operations.

As AI becomes capable of supporting more complex workflows, organizations also need to determine where human approval remains necessary.

This is particularly important in financial and operational environments.

Consider bank reconciliation.

An intelligent system might be able to:

Import transactions → Identify potential matches → Detect exceptions → Recommend resolutions

But organizations may still require a finance professional to approve specific exceptions before anything is posted.

The objective should therefore not always be 100% autonomous automation.

In many situations, a more appropriate model is:

AI identifies → AI recommends → Human reviews → System executes

This approach allows organizations to gain efficiency while maintaining appropriate controls.

Real estate platforms contain sensitive financial, tenant, vendor, lease, and operational information.

Organizations therefore need clear rules governing how AI can access and use that information.

Important questions include:

• Which data can AI access?
• Which applications can AI interact with?
• What actions can AI perform?
• Which actions require human approval?
• How are AI activities logged?
• How are permissions managed?
• How are exceptions reviewed?

AI governance should be designed alongside the technology architecture rather than introduced after deployment.

For organizations running platforms such as Yardi Voyager or MRI Software, AI readiness should begin with the existing enterprise environment.

That means reviewing areas such as:

System Configuration → Data Quality → Integrations → Reporting → Automation → Security → Governance

Organizations do not necessarily need to replace their core property management systems to become AI-ready.

In many cases, the bigger opportunity is to modernize the architecture around those platforms.

This may include improving integrations, eliminating unnecessary manual processes, cleaning data, strengthening reporting environments, and creating more reliable connections between the property management system and the broader technology ecosystem.

Once the underlying technology environment is prepared, organizations can begin identifying areas where AI can create practical value.

Property Accounting

AI and automation can support transaction matching, financial exception detection, invoice processing, reconciliation, and variance analysis.

Lease Administration

Document intelligence can help extract, classify, summarize, and analyze information from leases and related documents.

Property Operations

AI-assisted workflows can help teams organize maintenance requests, identify recurring issues, classify work orders, and prioritize operational information.

Reporting and Analytics

AI can complement traditional business intelligence by helping users explore portfolio information, summarize trends, and identify areas requiring further investigation.

Data Management

Intelligent tools can help identify duplicates, classify information, detect anomalies, and improve the way organizations work with large volumes of property data.

The goal should not be to introduce AI everywhere.

Organizations should prioritize use cases where AI can solve a measurable business problem.

Instead of starting with an AI product, organizations can begin with a structured readiness assessment.

Step 1: Map the Current Technology Environment

Document the systems supporting property management, accounting, leasing, construction, CRM, reporting, banking, and other critical operations.

Step 2: Identify High-Value Workflows

Look for processes involving high manual effort, repetitive tasks, large data volumes, or frequent exceptions.

Step 3: Assess Data Readiness

Evaluate data quality, accessibility, ownership, duplication, and governance.

Step 4: Review Integrations

Identify manual exports, outdated interfaces, custom scripts, disconnected applications, and opportunities for API-led integration.

Step 5: Automate Predictable Processes

Use workflow automation for repetitive and rules-based activities before introducing unnecessary AI complexity.

Step 6: Introduce AI Where Intelligence Adds Value

Apply AI where interpretation, prediction, classification, anomaly detection, document understanding, or decision support can meaningfully improve the process.

Step 7: Establish Governance and Human Controls

Define permissions, approvals, audit requirements, security controls, and accountability before scaling AI across the organization.

Step 8: Measure Business Outcomes

AI initiatives should be measured against business results rather than the number of AI tools deployed.

Depending on the use case, organizations can monitor metrics such as:

• Processing time
• Manual effort
• Exception volumes
• Error rates
• Reporting turnaround
• Workflow completion time
• User adoption

This can help organizations determine where AI and automation are producing meaningful operational improvements.

The next phase of real estate AI will not be defined simply by who adopts the most AI tools.

It will be defined by which organizations successfully connect data, enterprise systems, integrations, automation, governance, and AI into reliable operational workflows.

For companies operating complex Yardi, MRI, and multi-platform environments, that transition requires both technical expertise and a strong understanding of real estate business processes.

That is where an experienced PropTech consulting partner can make a difference.

Assetsoft helps real estate organizations modernize and optimize technology environments across Yardi, MRI Software, integrations, automation, analytics, and enterprise workflows.

Rather than treating AI as an isolated technology initiative, Assetsoft can help organizations examine the systems and processes that AI ultimately depends on.

Areas of support can include:

• Yardi consulting and optimization
• MRI Software consulting
• System configuration and optimization
• Data migration and data-quality initiatives
• API and system integration
• Workflow automation
• Reporting and analytics
• Process assessment
• AI-readiness planning

The objective is not simply to introduce another technology.

It is to create an enterprise environment where people, processes, data, automation, and AI can work together effectively.

Moving from AI pilots to production requires more than adopting the latest AI technology. Real estate organizations need clean data, optimized Yardi or MRI environments, reliable integrations, scalable automation, strong governance, and clearly defined human controls. By strengthening these foundations now, organizations can enter 2027 better prepared to turn AI experimentation into practical, secure, and measurable business value.

Ready to move beyond AI experimentation? Assetsoft can help assess your current technology environment and develop a practical roadmap toward connected, automated, and AI-ready real estate operations.

Q: What is the Rent Increase Guideline for 2026?

A: The Ontario government has set the 2026 Rent Increase Guideline at 2.1%.

This applies to rent increases taking effect between January 1, 2026, and December 31, 2026.

Q: Does this apply to all my units?

A: No. The most critical "switch" in your property management software this year is the New Build Exemption.

Units that were first occupied for residential purposes after November 15, 2018, are exempt from the 2.1% cap. For these units, you may increase the rent by any amount, provided you still give proper notice.

Q: What are the notice requirements?

A: You must provide 90 days’ written notice using the official Form N1 (for guideline increases) or Form N2 (for exempt units).

• Warning: A common error is counting "3 months" instead of "90 days." If you serve notice on February 1st for a May 1st increase, you might be short on days depending on the month lengths. The RTA is strict; being one day short voids the increase.

The Ontario market operates on specific rules that generic property management software configurations often miss.

If your system isn't distinguishing between "Pre-2018" and "Post-2018" units for rent control, or if your N4 notices are still defaulting to old timelines, you are exposing your portfolio to risk.

Assetsoft is a specialized consulting firm for the real estate industry. We are experts in Yardi Voyager and MRI Software. We don't just implement software; we configure it to align with the specific laws of the jurisdictions you operate in.

We can help you:

• Audit your Rent Roll for 2026 guideline compliance.
• Configure automated N1 and N4 notices that meet LTB standards.
• Clean up your data to ensure your LTB applications are bulletproof.
• Implement mobile apps for Fire Code documentation.

Is your portfolio ready for the 2026 rules?

Contact the Assetsoft team today to ensure your technology is working as hard as you are.