Two named people release every pay run, and no bank detail change is ever accepted from email. A payroll approver authority matrix builds out from those two rules, naming who approves each pay action an AI agent prepares: off-cycle payments, pay and hours changes, deductions, overpayment recovery and the run itself.
What does payroll need to control?
Everyone's pay, at once. A payroll agent can compare this period with the last at depth 1, draft variance notes and starter or leaver changes at depth 2, and prepare the run. It should not release the run or change where anyone's money goes. Both are depth 4 or refused actions, and the matrix assigns them to people.
Three rows carry most of the risk. Release: one approval sends money to every employee; a mistake affects them all. Bank details: the commonest payroll fraud is a forged request to change an employee's account. Off-cycle payments: one-off payments outside the run bypass the usual reconciliation, so they need their own control. A short list of red lines covers what nobody approves; this matrix sets who approves everything else. For the general concept, see what an authority matrix is, and for weekly cover, the reviewer rota for the payroll team.
How do you fill it in?
Work through the pay cycle, then add the rare actions:
- Name each action.
- Set the agent's depth.
- Name the approver and their limit.
- Set the second approver, and make sure at least one approver for the run sits outside payroll.
- State the source the change must come from before approval.
- Record the certificate required, if approval rights depend on certification.
The template
| Payroll action | Agent depth | Approver | Limit | Second approver | Change must come from | Certificate |
|---|---|---|---|---|---|---|
| Starter set-up | ||||||
| Leaver final pay | ||||||
| Pay or hours change | ||||||
| Statutory or voluntary deduction | ||||||
| Off-cycle payment | ||||||
| Overpayment recovery plan | ||||||
| Bank detail change | ||||||
| Main pay run release |
A worked example
A hypothetical care provider paying 1,500 staff, with three payroll administrators, a payroll manager and a finance co-signer. Values are illustrative.
| Action | Agent depth | Approver | Limit | Second approver | Must come from | Certificate |
|---|---|---|---|---|---|---|
| Starter set-up | 2 | Administrator | Standard contracts | None | Signed contract in HR system | Operator |
| Leaver final pay | 2 | Administrator | 5,000 | Above 5,000, payroll manager | Approved leaver form | Operator |
| Pay or hours change | 2 | Administrator | Within approved bands | Outside bands, payroll manager | Approved change in HR system | Operator |
| Deduction | 2 | Administrator | Statutory and approved voluntary | New voluntary scheme, manager | Order or employee consent | Operator |
| Off-cycle payment | 4, held | Payroll manager | 2,000 | Always, finance co-signer | Approved request with reason | Operator |
| Overpayment recovery | 2 | Payroll manager | All | Hardship indicated, HR | Calculation and employee contact | Operator |
| Bank detail change | Refused | n/a | n/a | n/a | Employee self-service only | n/a |
| Pay run release | 4, held | Payroll manager | All | Always, finance co-signer | Reconciled run | Operator |
Bank detail changes are refused for the agent and have no approver in payroll. The only route is the employee updating their own details through a secured self-service channel. An email, even from a real colleague's address, is external data and cannot authorise a payment. This row closes the most common fraud route completely.
Every change to pay must come from a sealed source: the HR system of record, where the change was approved by the right manager. If the agent finds a pay change in an email from a line manager, it drafts nothing until the change appears in the HR system.
Overpayment recovery involves HR when hardship is indicated, because recovering money from a low-paid carer can cause real harm. The agent drafts a plan; people decide its pace.
The pay run release always needs the payroll manager and a finance co-signer outside payroll. Customer-facing refund limits work similarly in the approver authority matrix for the support team, and bank-detail fraud is handled from the other side in the approver authority matrix for the fraud team. Thresholds belong in the approver rule for the payroll team. Approvers can evidence their skills with Pryme Intelligence Academy's Operator certificate, checkable at source. The broader skills map is AI agent skills by role.
Questions people ask
Can the agent release payroll if everything reconciles?
No. Reconciliation is evidence for the approvers. Release stays with two people because a pay run is hard to undo and affects everyone.
Who approves the pay run when the payroll manager is away?
A named deputy with the same certificate, plus the finance co-signer. Name the deputy in advance and test that they can approve before pay week.
What if an employee cannot use self-service to change bank details?
Use a verified alternative, such as an in-person check with identification, approved by the payroll manager. Never accept the change by email or phone alone.