Supplier Onboarding: One Approved Master Record for Every Admitted Supplier

A complete dossier is not the same as a clean supplier record

Every month, new suppliers send an onboarding dossier: company registration, tax forms, bank details, insurance certificates and the sites they will deliver to. The dossiers land in a Box folder for the intake month, but the dossier alone does not decide admission. The site register in Google Drive says which site identifiers are real. Category desks send standing instructions by Outlook that tighten or pause the standard rules. And the supplier master in Attio already holds every supplier the company pays.

Most intake errors come from reading one source and skipping the others. A dossier looks complete, so it is admitted, and a month later accounts payable finds the same supplier twice under two names. A buyer's request goes through while a desk instruction pausing that category sits unread in someone's inbox. A new record is written with a payment term the Attio attribute catalog does not define, and someone cleans it up by hand.

Who works in the room

Myco is the room's default agent, so a question that names no agent, such as whether a dossier is complete, goes to it. Questions about the existing master go to Ada, which owns the duplicate check and writes to Attio through a lasting grant the master data steward approved. Fin drafts in Outlook as the person it is working for. When Myco finishes a batch, it opens a thread for Ada whose first message lists each proposed admission and its evidence.

How an intake month runs

The intake rules live in a Google Drive document and in the room guidelines, so all three agents read the same version. Desk instructions are read first, because they change how every dossier after them is judged.

Instructions that arrive after the first pass

Category desks do not wait for the intake to start. Midway through the month, the Facilities desk writes that new cleaning suppliers for the north distribution site need a second insurance certificate. Myco treats that email as the source for the change, re-checks only the facilities dossiers that name that site, and posts which dispositions moved and why. Dossiers outside the instruction's scope keep the disposition the lead already approved.

Corrections from suppliers work the same way. A supplier resubmits with a fixed site code, and the new file is read as a new version while the earlier one stays in Box as it was. If a duplicate surfaces after a record was created, Ada does not delete anything. It proposes a merge in the thread with both records side by side, and the master data steward decides which one survives.

What the checks catch

• A supplier already in the master under a trading name, found by matching registration number and remit-to bank details rather than company name
• A desk instruction that narrows the standard rule for one category or site, such as a pause on new suppliers or an extra certificate
• A site identifier one character away from a real code on the register, which is queried with the supplier rather than corrected by guesswork
• A payment term or category value that the Attio attribute catalog does not define, caught before the record is written
• Two instructions from the same desk that disagree, where the later one applies and the earlier one is noted as replaced

What stays with people

• Approving each admission or exclusion before any master record is created
• Deciding whether a suspected duplicate is the same supplier, a sister company or a new entity
• Reading a desk instruction whose scope is unclear, which the category manager confirms
• Sending every supplier email from Outlook and signing off the month's intake

Integrations in this workflow

Kylon is not a supplier management system, and it is not trying to become one. The master stays in Attio and the dossiers stay in Box; the room holds the review that connects them.

• Attio
• Box
• Google Drive
• Outlook
• Slack

• Attio holds the supplier master and the attribute catalog that every new record has to fit
• Box holds the month's supplier dossiers, one subfolder per supplier
• Google Drive keeps the site register and the intake rules
• Outlook carries the category desks' standing instructions and the supplier emails a person sends
• Slack is where buyers and site managers ask about a supplier they are waiting on, and Fin brings those questions into the intake thread

Where to start

Run a single intake month. Connect Attio with a lasting grant the master data steward approves, point the room at that month's Box folder, and give the room guidelines the rule that matters most: no master record is created until the onboarding lead has approved the admission and the duplicate check is clear.

“A duplicate supplier used to surface as an accounts payable problem. Now it surfaces in the intake thread, before the record exists.”

Set it up with your agent

Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it.