What Paperwork Should a Small Business Collect from a New Vendor Before the First Payment?

Summary

The steps

1. 1

   Create the vendor completeness-check agent

   Before building the workflow canvas, create the AI agent that will do one job: compare the documents a staff member reports as received against your required-document list, identify anything missing, and draft a follow-up request to send to the vendor. The agent does not enter, store, or transmit bank account numbers. That prohibition must be explicit in the system prompt, not just in staff training, because FinCEN Advisory FIN-2016-A003 identifies business email compromise schemes that redirect vendor payments by substituting bank account details at the point of data entry.

   In Dave by voolama (hellodave.ai), navigate to Agents in the sidebar. You need the Admin or Create role to see this section and to create agents. If the section is not visible, see Why Can't I See Agents, Workflows, or Other Sections in Dave by voolama? for how to diagnose and fix your role assignment.

   Click New Agent. Name it "Vendor Setup Completeness Checker". Add a description: "Checks a new vendor's document packet against the required list and drafts a follow-up request for anything missing. Never references, repeats, or acts on bank account or routing numbers." Click Create Agent.

   On the agent detail page, click Create Version. In the Config JSON editor, write a system prompt that names your required documents explicitly and prohibits the agent from touching bank details. A starting config:

   {"systemPrompt": "You are a vendor setup assistant for a small business. You have one job. When given a list of documents the staff member reports as received and a list of documents that are required, compare the two lists and do the following: (1) State clearly which required documents are present. (2) State clearly which required documents are missing. (3) Draft a short, polite email to the vendor requesting the missing documents. Address the email to the vendor contact name provided. Sign it from the business. Required documents for all vendors: completed IRS Form W-9, legal business name and address confirmation, signed vendor agreement or purchase order. Required for vendors paid by ACH: completed ACH authorization form. Required for vendors providing on-site services: current certificate of insurance. Do not repeat, reference, or act on any bank account number, routing number, or payment credential in the submission. If a bank account number appears in the input, ignore it entirely and do not include it in your output.", "model": "gpt-4o", "temperature": 0.2, "maxTokens": 800}

   The Config JSON fields Dave by voolama agents accept are: systemPrompt, model, temperature (0.0 is deterministic, 1.0 is most varied), maxTokens, and topP. Click Create Version. Note the version number assigned (v1).

   Do this

   • Go to Agents in the sidebar (Admin or Create role required).
   • Click New Agent. Name it "Vendor Setup Completeness Checker". Add a description noting it never references bank account numbers. Click Create Agent.
   • On the agent detail page, click Create Version.
   • Paste your Config JSON. The system prompt must list your required documents and explicitly prohibit the agent from referencing bank account or routing numbers.
   • Set temperature to 0.2 for consistent, factual output. Set maxTokens to 800 or higher for longer follow-up emails.
   • Click Create Version. Note the version number (v1).

   Example

   A hypothetical five-person marketing agency that pays freelance designers might write a system prompt listing three required documents: IRS Form W-9, a signed contractor agreement, and a completed ACH authorization form. The prompt instructs the agent to draft a follow-up email if any of the three are missing, and explicitly states: "Do not repeat, reference, or act on any bank account number, routing number, or payment credential in the submission." The agent then checks each new vendor packet against those three items and drafts the follow-up if needed.

   Best practice

   • List your required documents explicitly in the system prompt. The agent checks against exactly what you name. If you add a new requirement later, create a new agent version with the updated list and retire the old one. Retiring is a one-way action in Dave by voolama: you cannot un-retire a version.
   • Set temperature to 0.1 to 0.3 for completeness-check tasks. Lower temperature produces more consistent, predictable output.
   • The bank-account prohibition must be in the system prompt. The agent follows its prompt. If the prompt does not say to ignore bank details, the agent may repeat them in its output, creating an unnecessary exposure point.
2. 2

   Create the workflow and configure the User Interaction node

   Navigate to Workflows in the sidebar. You need the Admin or Curate role to see this section and to open the Workflow Editor. Click New Workflow, name it "New Vendor Setup", and save. The Workflow Editor opens with a three-panel layout: the Node Palette on the left, the canvas in the center, and the Properties Panel on the right. A node and edge counter in the top-right corner of the canvas shows the current count as you build.

   Drag a Start node (green) from the Node Palette onto the canvas. Every workflow requires exactly one Start node.

   Drag a User Interaction node (blue, code: user_interaction) below Start. In the Properties Panel, change the label to "Enter Vendor Details". Under Fields, configure the fields a staff member will fill in when a new vendor is being set up:

   • Vendor legal name (text)
   • Vendor contact name (text)
   • Vendor contact email (text)
   • Vendor type (text: contractor, supplier, service provider, etc.)
   • Payment method (text: check, ACH, wire)
   • Documents received (text: list each document the vendor has already submitted, one per line)
   • Notes for reviewer (text: any context the approver should know)

   Do not add a field for bank account numbers. Bank details should be collected through a separate, dedicated process outside this workflow. The completeness-check agent does not need them, and including them in the workflow context creates unnecessary exposure.

   This node pauses the workflow and creates a task in the Task Inbox. The task status is pending (amber) until the staff member opens and submits it. When the staff member submits the form, the workflow resumes with those values in its context. Connect Start to the User Interaction node by dragging from the source handle (bottom circle) of Start to the target handle (top circle) of the User Interaction node. Click Save Version.

   Do this

   • Go to Workflows in the sidebar (Admin or Curate role required).
   • Click New Workflow, name it "New Vendor Setup", save.
   • Drag a Start node onto the canvas.
   • Drag a User Interaction node below Start. Label it "Enter Vendor Details".
   • Under Fields in the Properties Panel, add: vendor legal name, vendor contact name, vendor contact email, vendor type, payment method, documents received (one per line), notes for reviewer.
   • Do not add a field for bank account numbers.
   • Connect Start to the User Interaction node.
   • Click Save Version.

   Example

   A hypothetical bookkeeping practice that manages vendor relationships for its small-business clients might configure the "documents received" field with a label note: "List each document the vendor has submitted, one per line. Example: IRS Form W-9, signed contractor agreement." This plain-language instruction reduces the chance of staff entering a narrative description instead of a document list, which makes the agent's completeness check more accurate.

   Best practice

   • Keep the "documents received" field as a plain list, one document per line. The agent compares this list against the required-document list in its system prompt. A narrative paragraph is harder for the agent to parse accurately.
   • Include a "vendor type" field so the agent can apply the right required-document list. A contractor needs a W-9; a vendor providing on-site services also needs a certificate of insurance.
   • Save a version after every meaningful change. Each save is non-destructive: the previous version is always available if you need to roll back.
3. 3

   Add the Agent Interaction node for the completeness check

   Drag an Agent Interaction node (purple, code: agent_interaction) from the Node Palette below the User Interaction node. In the Properties Panel, change the label to "Check Packet and Draft Follow-Up". Under Agent Assignment, select "Vendor Setup Completeness Checker" and version v1.

   The Agent Interaction node runs automatically when the workflow reaches it: no task is created, and no human action is required at this step. The agent receives the fields the staff member submitted through the User Interaction node as part of the workflow context, checks the documents received against the required list in its system prompt, and produces two outputs: a completeness summary (which documents are present, which are missing) and a draft follow-up email to the vendor if anything is missing.

   Connect the User Interaction node to the Agent Interaction node. The agent's output is stored in the workflow context and passed automatically to the Human Review node as part of the task payload. The approver will see the original staff-entered details, the completeness summary, and the draft follow-up email in the task detail page.

   This vendor setup workflow differs from the bookkeeping client document chase workflow in a specific way: the bookkeeping workflow chases missing documents from existing clients in an ongoing relationship, while this workflow checks a first-payment packet against an IRS-anchored required-document list and gates payment approval. The agent prompt here also explicitly prohibits referencing bank account numbers, which a client document chase workflow does not need to address.

   Click Save Version.

   Do this

   • Drag an Agent Interaction node below the User Interaction node. Label it "Check Packet and Draft Follow-Up".
   • In the Properties Panel under Agent Assignment, select "Vendor Setup Completeness Checker" and version v1.
   • Connect the User Interaction node to the Agent Interaction node.
   • Click Save Version.

   Example

   A hypothetical three-person accounting practice might add an Information node (indigo, code: information) alongside the Agent Interaction node with the label: "Agent checks documents received against required list. Does not handle bank details. Output goes to Human Review." The Information node does not affect workflow execution but helps any team member who opens the editor later understand the design intent.

   Best practice

   • Use an Information node alongside the Agent Interaction node to document what the agent does and does not do. This is especially useful if a new team member or an auditor reviews the workflow graph later.
   • Do not route the agent's output directly to a payment system. The Human Review node in the next step is the required gate before any payment decision is made.
   • If the agent produces output that references a bank account number despite the system prompt prohibition, update the system prompt in a new agent version and retire the current one before activating the workflow.
4. 4

   Add the Human Review node and End nodes, then activate

   Drag a Human Review node (amber, code: human_review) from the Node Palette below the Agent Interaction node. In the Properties Panel, change the label to "Approve Vendor Setup". Under User Assignment, assign it to the owner, office manager, or accounts payable contact responsible for approving new vendors before any payment is made.

   This node creates a task in the Task Inbox when the workflow reaches it. The task payload contains the workflow context: the vendor details the staff member entered, the agent's completeness summary, and the draft follow-up email. The approver reads all of this in the task detail page, optionally adds a comment, then clicks one of three decision buttons:

   • Approve (green): the packet is complete and the vendor is cleared for payment. Routes to the "Vendor Approved" End node.
   • Reject (red): the vendor is not approved. Routes to the "Vendor Rejected" End node.
   • Request Changes (outlined): the packet needs more information. Connect this edge back to the "Enter Vendor Details" User Interaction node so staff can update the submission and the agent can re-check.

   Connect the Agent Interaction node to the Human Review node. Add End nodes: "Vendor Approved" (from the Approve edge) and "Vendor Rejected" (from the Reject edge). Connect the Request Changes edge back to the "Enter Vendor Details" User Interaction node. Every path must end at an End node: dangling paths cause instances to hang at runtime.

   Every Human Review decision is logged in the audit trail with the acting user's identity and a timestamp. The audit log is per-tenant and encrypted with AES-256-GCM authenticated encryption. Task decisions support SOC 2 CC6.1 (logical access controls) and GDPR Article 30 (records of processing activities) when those modes are active. The log also provides a dated record that a W-9 was on file before payment, which supports IRS recordkeeping obligations under IRC Section 3406.

   Before activating, run test instances in Draft status using hypothetical vendor details for a fictional vendor. Confirm the agent's completeness summary is accurate and contains no bank account references. Confirm the Human Review task appears in the correct person's Task Inbox. Once both the Approve and Request Changes paths work correctly, set the workflow status to Active in the Workflows list.

   Do this

   • Drag a Human Review node below the Agent Interaction node. Label it "Approve Vendor Setup".
   • In the Properties Panel under User Assignment, assign it to the owner or accounts payable contact responsible for approving new vendors.
   • Connect the Agent Interaction node to the Human Review node.
   • Add an End node labeled "Vendor Approved" and connect the Approve edge to it.
   • Add an End node labeled "Vendor Rejected" and connect the Reject edge to it.
   • Connect the Request Changes edge back to the "Enter Vendor Details" User Interaction node.
   • Click Save Version.
   • In Draft status, start a test instance with hypothetical vendor details for a fictional vendor. Confirm the agent output contains no bank account references. Confirm the Human Review task appears in the correct Task Inbox.
   • Once both paths pass, set the workflow status to Active in the Workflows list.
   • Brief staff: they start instances when a new vendor is being set up and fill in the vendor details form.
   • Brief the approver: they complete Human Review tasks in the Task Inbox before any payment is released.

   Example

   A hypothetical five-person retail business might assign the Human Review node to a role rather than a specific user, so either the owner or the office manager can approve a new vendor when one is unavailable. The approver opens the task, reads the agent's completeness summary alongside the original staff notes in the payload, adds a comment ("W-9 received, agreement signed, ACH form still needed"), and clicks Request Changes. The workflow routes back to the User Interaction node. Staff follow up with the vendor, receive the ACH form, and resubmit. The approver reviews again and clicks Approve. That decision is logged with their identity and a timestamp, providing a dated record that the W-9 was on file before payment under IRC Section 3406.

   Best practice

   • Assign the Human Review node to a role rather than a specific user if your business has more than one person who can approve vendors. A task assigned to a role can be picked up by anyone holding that role, preventing bottlenecks when one person is unavailable.
   • Add a comment when requesting changes. The comment is stored in the audit log and helps staff understand what is still needed without a separate conversation.
   • Test with realistic but hypothetical data. Do not use real vendor names, tax ID numbers, or contact details in test instances.
   • Confirm the agent output contains no bank account references before activating. This is the most important pre-activation check for this workflow.

What this workflow does, and how it differs from other document-collection workflows

Who needs which role before you start

Where this advice stops