PayFlow Sentinel — Agentic Procure-to-Pay Orchestration

An agentic P2P system that orchestrates LangChain, CrewAI, and Claude Code agents through UiPath Maestro BPMN — detecting procurement fraud in real time for African enterprises.

Comment

PayFlow Sentinel — Agentic Procure-to-Pay Orchestration for African Enterprises

💡 Inspiration

I've watched Nigerian businesses bleed through procurement cycles that nobody talks about in the global fintech conversation. A purchase requisition submitted on Monday doesn't get paid until the third week of the following month — not because the business is broken, but because every step requires a human to forward an email, chase an approval, or manually reconcile an invoice against a PO that lives in a different spreadsheet.

The fraud layer makes it worse. Vendor name impersonation — "Lagos Office Suppliies Ltd" instead of "Lagos Office Supplies Ltd" — costs enterprises millions before anyone notices. FX rate inflation on USD invoices quietly drains budgets. Duplicate invoices get paid twice because AP teams are processing 400 documents a month with no tooling.

When I saw the UiPath AgentHack brief — specifically the Track 2 example of a procure-to-pay process orchestrated by Maestro BPMN — I realized this was the exact architecture that African enterprise procurement needed. Not a chatbot. Not a dashboard. A structured, auditable, agentic process that moves work from requisition to payment with AI doing the fraud detection and humans staying in control of the decisions that matter.

That's PayFlow Sentinel.

🏗️ How I Built It

Architecture Overview

The system has three layers:

┌──────────────────────────────────────────────────────┐
│           UiPath Maestro BPMN                        │
│     (Orchestration & Governance Layer)               │
└──────────┬───────────────────────────────────────────┘
           │
┌──────────▼───────────────────────────────────────────┐
│  ReqParser      VendorScout       InvoiceGuard ★     │
│  LangChain      CrewAI            Claude Code        │
│  + Claude       Multi-Agent       via UiPath CLI     │
└──────────┬───────────────────────────────────────────┘
           │
┌──────────▼───────────────────────────────────────────┐
│     FastAPI Mock ERP · Railway · REST APIs           │
└──────────────────────────────────────────────────────┘

The BPMN Process

I modelled the full P2P lifecycle as a BPMN 2.0 process in UiPath Maestro with conditional gateways, process variables, and swimlanes separating agents, robots, and humans:

  1. PR Submitted → ReqParser Agent parses raw text
  2. Budget Gateway — routes on estimated_value_ngn:
    • $< ₦5M$ → auto-route
    • $₦5M \leq x < ₦20M$ → CFO approval
    • $\geq ₦20M$ → Board approval
  3. VendorScout Agent → trust score $\in [0, 100]$
  4. Vendor Risk Gateway → approve / review / reject
  5. Human Task: PO Approval → UiPath Action Center
  6. RPA: Create PO → POST to ERP backend
  7. Human Task: Record GRN → warehouse confirmation
  8. InvoiceGuard Agent → 3-way match + forex + fraud score
  9. Invoice Risk Gateway — routes on invoice_risk_score:
    • $score < 25$ → auto-pay
    • $25 \leq score < 60$ → AP escalation
    • $score \geq 60$ → reject
  10. RPA: Execute Payment → payment reference + audit log

Agent 1 — ReqParser (LangChain + Claude Sonnet)

Built inside UiPath Agent Builder using LangChain + LangGraph with three tools: budget code lookup, balance check, and vendor registry search. Takes raw PR text from any source — email body, form submission, PDF extract — and returns:

{
  "vendor_name": "Lagos Office Supplies Ltd",
  "category": "office_supplies",
  "estimated_value_ngn": 2400000,
  "budget_code": "OPS-2026-Q2",
  "urgency": "standard",
  "flags": ["exceeds_5m_threshold"],
  "confidence": 0.94
}

Agent 2 — VendorScout (CrewAI Multi-Agent)

Two sub-agents working sequentially:

  • Researcher Agent: Searches vendor registry, checks CAC registration numbers, scans for name-similarity fraud using Jaccard overlap scoring on vendor name tokens
  • Risk Scorer Agent: Synthesizes findings into a trust score using weighted signals — blacklist hits (−80), duplicate name similarity > 0.7 (−40), no CAC (−25), transaction history (+variable)

The name-similarity check catches the most common Nigerian procurement fraud pattern: slight misspellings designed to pass visual inspection but fail exact-match filters.

Agent 3 — InvoiceGuard ★ (Built with Claude Code via UiPath for Coding Agents)

This agent was built entirely using Claude Code through the UiPath CLI integration — qualifying for the coding agent bonus points. It runs three independent checks:

3-Way Match — reconciles PO, GRN, and Invoice:

$$\delta = \left| \frac{V_{invoice} - V_{PO}}{V_{PO}} \right| \times 100$$

Any $\delta > 2\%$ triggers an exception. Ghost line items (present on invoice, absent from PO) are flagged independently.

Forex Validation — catches FX rate inflation:

$$overcharge = V_{invoice} - \left(\frac{V_{invoice}}{r_{claimed}} \times r_{actual}\right)$$

Where $r_{claimed}$ is the vendor's stated USD/NGN rate and $r_{actual}$ is the live rate from ExchangeRate-API. Deviations $> 3\%$ from the official rate are flagged.

LLM Fraud Scoring — Claude Sonnet scores 0–100 for:

  • Round-number fraud (invoice total divisible by ₦500,000+)
  • Backdating (invoice date precedes PO creation date)
  • Price inflation above market benchmarks
  • Duplicate invoice number patterns
  • Just-under-threshold amounts (classic split invoice fraud)

The composite risk score weights the three checks:

$$R_{composite} = 0.40 \cdot R_{match} + 0.25 \cdot R_{forex} + 0.35 \cdot R_{fraud}$$

Backend

FastAPI server providing vendor registry, PO management, invoice store, and payment logging. Deployed on Railway via Docker with a public /docs Swagger UI. Seed data includes 6 Nigerian vendors, 5 blacklisted entities with fraud case notes, and 7 department budget codes.

🧗 Challenges I Faced

BPMN rendering in Maestro — the first BPMN import failed with "No diagrams found." The issue was that Maestro requires both the <process> definition and a <bpmndi:BPMNDiagram> section with pixel-exact X/Y coordinates for every shape and edge. I had to regenerate the file with full DI (Diagram Interchange) markup — 27 shapes and 30 edges with explicit waypoints.

Condition expression validation — Maestro throws validation errors if any outgoing flow from an exclusive gateway is missing a <conditionExpression>. Labels are not sufficient. I had to add formal expressions to all 15 gateway outflows and ensure XML-escaped operators (&amp;&amp;, &lt;, &gt;) throughout.

Railway deployment — three iterations to get the FastAPI backend live. Railpack couldn't detect the app from the repo root (backend was in a subfolder). Switching to Nixpacks broke because the nix environment didn't expose pip. The fix was a plain Dockerfile with python:3.11-slim and ${PORT:-8000} in the CMD so Railway's dynamic port assignment worked correctly.

RPA connection error on publish — Maestro blocked publishing with "RPA connection server needs recovery" because the service tasks were typed as Robot tasks requiring a registered UiPath Robot. Since UiPath Labs doesn't come with a pre-registered robot, I converted both RPA tasks to HTTP Service Tasks pointing at the Railway backend — functionally equivalent for the demo and cleaner for the submission.

Solo build, 3-day window — I saw the hackathon late. Everything from architecture to deployed backend to five demo scenarios was built in under 72 hours. The constraint forced me to be ruthless about what the judges actually evaluate versus what sounds impressive in a README.

📚 What I Learned

UiPath Maestro BPMN is genuinely different from other orchestrators. The combination of visual process modelling, live instance monitoring, and Action Center for human tasks is something that workflow tools like Airflow or Prefect don't offer. Watching a process instance move through the BPMN diagram node by node in real time — with human tasks pausing the flow until someone acts — is a different mental model from DAG-based orchestration.

Claude Code as a development tool, not just an assistant. Using Claude Code through the UiPath CLI to generate InvoiceGuard's three modules felt different from prompting in a chat interface. It generated three_way_match.py, forex_checker.py, and fake_detector.py as production-quality Python with proper error handling and fallback logic. The fake_detector.py combined an Anthropic API call with a rule-based engine so the agent degrades gracefully when the LLM is unavailable.

CrewAI's sequential process model fits fraud detection well. The Researcher → Risk Scorer pattern maps naturally to how a human analyst would actually investigate a vendor: gather facts first, then score. Having the Risk Scorer receive the Researcher's full findings as context produces noticeably better trust score reasoning than a single-agent approach.

African market context is an engineering constraint, not just a framing choice. NGN currency, CAC registration numbers, local fraud patterns (name-similarity attacks, round-number invoicing, just-under-threshold split invoicing) — these aren't cosmetic. They shaped the prompts, the blacklist schema, the forex checker, and the risk scoring logic at every level.

⚙️ Built With

Orchestration

  • UiPath Maestro BPMN 2.0
  • UiPath Automation Cloud (UiPath Labs)
  • UiPath Action Center
  • UiPath API Workflows

AI & Agents

  • UiPath Agent Builder
  • UiPath for Coding Agents (Claude Code via @uipath/cli) ★
  • Claude Sonnet (Anthropic) — ReqParser + InvoiceGuard fraud scoring
  • LangChain · LangGraph — ReqParser agent framework
  • CrewAI — VendorScout multi-agent crew

Backend & Infrastructure

  • Python 3.11 · FastAPI · Uvicorn
  • Docker · Railway (cloud deployment)
  • ExchangeRate-API (live USD/NGN forex rates)
  • GitHub (MIT License)

Built With

Share this project:

Updates

Submission history