Flagging is not fixing

A Buyers Edge audit went through 11,000 invoices from 400 restaurants and found overcharges on 35% of them, worth about 1% of invoice dollars. One percent sounds small. The source sets it beside the median full-service restaurant margin of 2.8% of revenue before tax (National Restaurant Association, 2025), but the two figures have different denominators, invoice dollars are not revenue, so the leak's true share of profit depends on supplier spend as a share of revenue, which the source does not give. What the figures do establish is the shape of the problem: the leak stays unfixed because checking each invoice by hand costs more than the error on that invoice. So nobody checks.

Software already catches these errors. MarginEdge, xtraCHEF, Restaurant365, and Ottimate all capture line items, and Craftable goes furthest, matching invoice lines against contracts at SKU level and flagging overcharges before payment. Then everyone stops. The restaurant industry's own write-up of the idea puts it bluntly:

Everyone flags the overcharge. Nobody chases the credit.

That sentence is the pattern behind the top-ranked ideas in the October shortlists. Each week, the AISideProjects corpus scores dozens of podcast episodes, newsletters, and IdeaBrowser editions and ranks the buildable ideas. In October 2026 the top of the ranking kept rewarding the same shape of business: an agent that finds money a company is already owed, then does the unglamorous work of collecting it. Filing the claim. Attaching the proof. Following up until someone pays, or refuses in writing.

One qualification on those ranks, because it matters for how much weight they carry: the shortlist is this pipeline's internal selection rubric, and its score includes owner fit, how well an idea matches one specific builder's experience. A first-place rank says an idea suits this pipeline; it is not market validation.

The restaurant invoice agent ranked first in the October 26 shortlist at 22/25. It reads every supplier invoice against the contracted price, documents the difference, submits the claim, and chases the distributor. The price is 25% of whatever it recovers, so the customer pays only when money comes back. A support-bot reconciliation tool ranked first the week before, also at 22/25, with a very different design that turns out to matter. A third entry, detention-fee recovery for trucking fleets, scored lower. Why it scored lower says as much as the wins.

Trucking fleets earn detention fees when a truck waits too long at a loading dock. The American Transportation Research Institute has measured average detention rising by roughly 30 minutes per stop since 2014, and the source puts direct unpaid detention at $3.6 billion a year. Small carriers, the target here is fleets of 5 to 100 trucks, mostly write the fees off. Filing takes timestamps, contract terms, and repeated follow-up, and dispatchers have freight to move.

The proposed agent takes the filing off the dispatcher. It pulls arrival and departure times from the fleet's own tracking data, reads the free time and hourly rate from the broker's contract, files the claim the next day, and chases until the broker pays or refuses in writing. The entry describes that chase two ways, a days 7, 14, 21, and 30 cadence in its concept and days 3, 7, and 14 with human escalation at day 30 in its core paid plan, and never reconciles the two. Either way, the cadence is not a detail. The cadence is the product.

Ecommerce support has the same shape of leak, newer and stranger. Gorgias put an autonomous support agent in front of more than 2,000 brands in under a year, resolving 35 to 60% of tickets at $0.90 to $1.00 per resolution. The mistakes it makes are concrete. A wrong refund amount. A duplicate refund. The wrong order cancelled. A subscription reported as paused that never paused. Cloud Security Alliance figures cited in the source say 53% of organisations saw AI agents exceed their permissions in the past year, and 31% of agent-adopting enterprises had an agent change money or rewards based on policy it invented. Ravelin estimates $1.5 billion a year lost by North American e-tailers to refund and policy abuse.

The tool built on top of this mess does the opposite of the recovery agents. It is read-only. Every night it cross-checks what the support agent promised in Gorgias or Zendesk against the records in Shopify, Stripe, and Recharge, and surfaces only the mismatches, in an exception inbox for a human to fix. It never touches a money system. It flags. Flagging is the entire product.

That restraint is the wedge, not a limitation. A brand burned by an agent issuing a full refund against a no-refund policy will not hand a second agent write access to its refunds. Verification earns trust because it cannot act. The oversight world is converging on the same point from the other direction: on The Cognitive Revolution's GovAI episode, the guest notes that monitoring of agents is mostly after the fact, that synchronous monitoring, watching in real time with the ability to block, is still the open gap, and that agent identifiers remain underdeveloped.

Put the three cases side by side and the rule writes itself. In restaurants and trucking, detection was already solved and the missing step was collection. In support, detection is unfinished work, but the shelf is not empty: the same source entry names ResponseCX, which claims self-verification across Shopify and Stripe, and Provy, described as a horizontal outcome-assurance reconciler. The narrower gap this design claims is independence, a cross-vendor, read-only checker that does not sell the support agent it audits, and trust was the missing step either way. Find where the value stops. Then ask whether it stops because the next step is hard and adversarial, or because nobody has earned the right to take it yet.

Why incumbents stop there is not documented in the sources. The plausible explanation is economic, and it is a hypothesis, not a finding: flagging is software, clean margins, no adversarial counterparty, no per-claim labor, while chasing is a dispute with the customer's own suppliers, in the restaurant case with distributors the restaurant needs again next week. A dashboard also sells to the person who owns the budget today. A recovery service has to prove dollars before it earns them.

Enterprise recovery firms prove the tier boundary. PRGX runs contingency audits at 10 to 40% for top-20 retailers and manufacturers, and has no restaurant practice at the 5 to 100 location tier. What the sources establish is the boundary, where incumbents' products stop. Whether the last step is declined for margin reasons or because collection is genuinely uneconomic at this tier is the question a builder has to answer before entering.

The three cases do not agree on how much autonomy is safe. Detention recovery is the most aggressive design on the table, an agent conducting a drawn-out collections argument with brokers, and it ranked Watch at 17/25 rather than Build. (That rank is the rubric's composite judgment; it does not isolate how much of the discount was the autonomy risk.) The source names the risk plainly: brokers can blacklist carriers who push claims too hard, and the relationship damage lands on the customer, not the software. It also gives the idea a window of roughly 12 to 18 months before a platform or factoring incumbent bundles detention recovery into an existing workflow.

The ceilings deserve the same cold water. IdeaBrowser tags all three ideas at roughly $5M to $15M in annual revenue potential. These are service-shaped businesses. Claim volume tracks the customer's transaction volume, so revenue grows the slow way. Pricing is not uniformly contingent, and the difference matters. The restaurant design takes 25% of recovered credits and the detention back-claim offer takes 20%, so that revenue arrives only after the chase succeeds. But detention's core product is a flat $99 per truck per month, and the support checker is a subscription at $1,500 or $3,500 a month. Only the recovery offers carry collection-dependent revenue; the subscriptions carry ordinary churn risk instead. A feature for a small team. A hard limit for anyone expecting software multiples.

• Pick a leak where the per-item value is small and the volume is large. If a human can profitably check one item by hand, the checking itself is not the opening; the opening, if any, is in volume, consistency, or the follow-through after the check.
• The proof burden is the pitch. These products sell recovered dollars, a number the customer can reconcile against their own accounts. That is a shorter argument than selling insight.
• Design the follow-up cadence as a product feature, not an afterthought. The detention entry describes two different cadences in its concept and its core plan; the restaurant entry describes distributor follow-up without publishing a schedule, which is a gap in that design, not a detail. Either way, the cadence and its templates per counterparty are product surface.
• Earn write access in stages. Start read-only where trust is low. Price on outcomes where the counterparty is a third party rather than the customer's own systems.
• Watch the bundling window. HappyRobot raised $150M in August 2026 for freight AI agents. When a funded platform adds your claim type as a checkbox, the standalone window closes.

Two developments would break the pattern. First, if the AP and support platforms ship claim-filing and cross-system verification themselves, and their distribution makes the standalone wedge worthless, the correct move becomes building on top of them rather than beside them. Second, if early recovery products show that counterparties simply refuse agent-filed claims at scale, by policy rather than by friction, then flagging was never a halfway step and the dashboard vendors had it right. Neither has happened yet in the sources tracked here. Until one does, the money is in the chase.

All articles · Research home