Decisions about a person's job, pay and privacy stay with people. An HR approver authority matrix states which actions an AI agent may complete, such as booking meetings, which it drafts, and who in HR or line management approves offers, pay changes, disciplinary letters, references and responses to access requests.
What should an HR matrix protect?
People's jobs, pay and privacy. HR agents usually read policies and records at depth 1, draft letters and replies at depth 2, and complete small, reversible tasks at depth 3, such as scheduling an interview. The matrix decides where each HR action falls and who signs it.
Three principles shape the rows. Decisions with real effect on an employee stay with a person who can explain them; under the GDPR, Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects. Health and other special-category data in drafts is checked before sending. And the approver is someone with authority over the decision itself: a line manager for leave, HR for policy exceptions, a senior manager for dismissals. The agent never stands in for any of them. This is the HR application of a general authority matrix.
How do you fill it in?
Use one row per HR action. For each, record:
- The agent's part and depth.
- The approver and their scope.
- The second approver, if any.
- The data check the approver must do before sending.
- Whether the action can be completed outside business hours, since some HR messages land badly late at night.
- The certificate required, if the organisation ties approval rights to certification.
The template
| HR action | Agent's part and depth | Approver | Scope | Second approver when | Data check before sending | Out-of-hours allowed | Certificate |
|---|---|---|---|---|---|---|---|
| Answer policy question | |||||||
| Schedule interview or meeting | |||||||
| Approve annual leave | |||||||
| Issue offer letter | |||||||
| Change pay or hours | |||||||
| Send disciplinary or grievance letter | |||||||
| Provide a reference | |||||||
| Respond to a data access request |
A worked example
A hypothetical hospitality group employing 3,000 people, with six HR advisers, two HR business partners, an HR operations lead and line managers across forty sites.
| Action | Agent's part | Approver | Scope | Second approver | Data check | Out of hours | Certificate |
|---|---|---|---|---|---|---|---|
| Policy question | Answers within policy (3) | None | Published policies | n/a | n/a | Yes | n/a |
| Schedule meeting | Books (3) | None | Non-disciplinary meetings | n/a | n/a | Yes | n/a |
| Annual leave | Drafts decision (2) | Line manager | Within allowance | Peak weeks, site manager | None | No | Foundations |
| Offer letter | Drafts (2) | HR adviser | Standard roles and pay bands | Off-band pay, business partner | Correct role, pay, start date | No | Operator |
| Pay or hours change | Drafts (2) | HR business partner | Within band | Outside band, ops lead | Approval trail present | No | Operator |
| Disciplinary letter | Drafts (2) | HR business partner | All | Dismissal, ops lead and senior manager | No health data unless relevant | No | Operator |
| Reference | Drafts factual reference (2) | HR adviser | Dates and role only | Any opinion, business partner | Facts traced to record | No | Operator |
| Access request | Assembles records (2) | HR operations lead | All | Always, data protection lead | Third-party data removed | No | Operator |
Disciplinary letters cannot be sent out of hours and always need a business partner. A letter inviting someone to a disciplinary hearing, arriving at 11pm, causes avoidable distress; the agent may draft it at any time, but it waits until morning.
References are limited to factual content, dates and role, unless a business partner approves more. Every fact in the agent's draft must trace to the HR record, a sealed source, rather than a manager's email.
Access requests always go to the operations lead and a data protection lead, because assembling an employee's records often sweeps in other people's personal data that must be removed before release.
Second-line review of HR's approvals sits in the approver authority matrix for the risk team. Detailed scopes belong in the approver rule for the HR team, and cover across sites in the reviewer rota for the HR team. HR staff can evidence their review skills with Pryme Intelligence Academy's Operator certificate. The skills each role needs are in AI agent skills by role.
Questions people ask
Can line managers approve the agent's drafts?
For actions within their own authority, such as leave, yes. For anything with legal or pay effect, HR approves, and line managers are consulted.
Should the agent ever reject a leave request?
It may draft a refusal where the rules are clear, such as no remaining allowance. A line manager sends it, so an employee can always talk to a person about it.
Who owns the HR agent?
Usually the HR operations lead. The owner answers for its bounds and should not be the routine approver of its letters about named employees.