Do you let Zaps pay invoices without someone clicking approve?

I’d handle payment approval separately from preventing duplicate payments.

My default would be to require approval for new recipients, changed bank details, or payments outside explicit per-payment and daily limits. Knowing the supplier wouldn’t be enough on its own. Tie approval to the exact recipient, bank details, amount and currency. If any of those change, the approval should no longer be valid. Record who approved that version and when.

Retries need their own protection. If a payment request times out, treat the outcome as unknown and reconcile with the provider before submitting another payment. Use a stable payment ID and provider-supported idempotency where available. Don’t rely on a “have we paid this?” lookup alone, since concurrent runs could both pass that check.

I’d first check whether the payment provider can enforce approval and keep the audit trail, with the Zap preparing the requests.

For repeat vendors, I’d automate the checks but keep a human in the release step: match invoice number, vendor, and amount against an unpaid ledger and purchase order, then hold duplicates, changed remittance details, or totals outside tolerance. Make approval expire if the invoice or bank details change, and require the approver to be different from whoever edited the vendor record. Log the source document and approval decision for audit. That keeps routine preparation fast while exceptions stop before money moves; I’d avoid a fully unattended first release.