Scope an HR information system connection field by field and person by person. The agent should see only the fields its capabilities need, and when serving an employee, only that employee's record. It can answer leave questions, log absences and draft onboarding tasks. Pay, bank details and job changes are held; disciplinary and dismissal decisions never reach it.
What does the connection cover, and who owns it?
An HR information system (HRIS) holds employee records: personal details, contracts, positions, pay, absence, leave, performance and sometimes health and diversity data. It is one of the most sensitive systems a firm runs. Agents can take a lot of routine load off HR teams: answering "how much leave do I have", logging sickness absence, preparing joiner paperwork. The same connection, set up loosely, lets any employee ask the agent about a colleague's salary.
The HR director owns what the agent may do. The data protection officer reviews access to personal and special-category data. The HRIS administrator configures it. Payroll owns anything that affects pay. The general approach is set out in how do you connect an AI agent to your systems?
What are the steps to connect it?
- Person, HR director: lists capabilities, the fields each needs and whose records each may touch.
- Person, data protection officer: reviews personal data use, excludes special-category fields by default, and decides whether a data protection impact assessment is needed.
- Person, HRIS administrator: creates the agent's identity with field-level access, not a standard HR role.
- Person, HRIS administrator: sets requester scoping: when an employee asks the agent something, the agent acts with that employee's context and reads only their record.
- Person, HR director, with payroll: sets held actions and named approvers for changes affecting pay, bank details, contracts or job details.
- Agent, depth 1: is tested with requests for other employees' data, phrased directly and indirectly, which must be refused.
- Agent, depth 2: runs a trial where every update is drafted for an HR adviser to apply.
- Person, HR director: approves the agent's depth.
- Person, HRIS administrator: tests revocation, including ending any session the agent holds on an employee's behalf.
What is scoped per capability, and at what depth?
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Answer leave and policy questions | Reads the requester's own record and policies | 1 | Nothing |
| Read org structure | Reads names, roles, reporting lines | 1 | Nothing |
| Log an absence reported by the employee | Records dates and type | 3 | Reviewing long-term absence |
| Update home address at the employee's request | Writes the field after authentication | 3 | Nothing |
| Change bank details | Prepares the change | 2 | Verifying and applying |
| Draft onboarding tasks | Prepares checklists and requests | 2 | Sending |
| Change pay, grade or contract | Drafts from an approved instruction | 2 | HR and payroll approval |
| Read health or diversity data | Nothing | none | HR specialists only |
| Disciplinary or dismissal actions | Nothing | none | HR and line manager |
Bank detail changes are held because they are a common route for payroll fraud. Dismissal and disciplinary actions stay out of reach entirely, for the reasons in irreversibility in HR decisions.
How do you stop one employee's data reaching another?
Scope every request to the requester. The agent should not hold standing read access to all records and decide what to reveal; it should only be able to read what the requester could see. A line manager asking about their team sees what a line manager may see in the HRIS, and nothing more.
Agents that share memory or pass notes between tasks can leak data across conversations, which is covered in how do agents share information without leaking it? Clear conversation context between employees, and do not let one employee's request leave traces another can retrieve.
What is recorded?
The HRIS audit log shows every read and write by the agent's identity, with the employee on whose behalf it acted. The agent's own record holds the request, the sources, the bound that decided, and the approver for held changes. Reads of employee records are logged as carefully as writes, because unauthorised viewing is itself a data protection breach.
Which controls make it safe?
Field-level access. The agent's role lists fields, not modules.
No special-category data by default. Health, ethnicity, religion, union membership and similar data are excluded unless a specific capability needs them and the DPO approves.
Strong authentication for changes. An employee changing their own details through the agent authenticates as they would in self-service.
Changes affecting pay go through payroll. Held, approved and applied before the payroll cut-off.
Revocation includes sessions. Disabling the agent ends any session it holds for an employee.
What should you measure?
Refused requests for other people's data, held changes and decision times, corrections to agent-logged absences, employee questions escalated to HR, and complaints about privacy. Any confirmed disclosure of one employee's data to another is an incident.
Where does it usually go wrong?
The agent gets an HR adviser's role. HR roles see everything. Build the agent's role from fields up.
Managers get more than they should. The agent answers a manager's question about an employee's medical absence detail because it can read it.
Free-text fields leak. Notes fields contain sensitive information that structured permissions do not cover. Exclude them unless needed.
Changes miss payroll. An address or grade change made by the agent after the cut-off creates a payroll error.
Where Pryme fits
In Pryme, the agent's sources are a bound on every action, so fields outside its capabilities do not reach it, and requests made on an employee's behalf carry that employee's context. Held changes wait for named HR or payroll approvers. The deployment path is in deploying an AI agent: train, shadow, certify, widen.
Questions people ask
Can the agent help with recruitment as well?
Recruitment is a separate capability with its own risks: decisions about candidates have significant effects on people and draw close legal scrutiny. Connect it separately, scope it to recruitment data, and keep shortlisting and decisions with people.
Should employees know they are talking to an agent?
Yes. Tell them plainly, and tell them how to reach an HR adviser at any point, especially for sensitive matters such as health or grievances.
Can the agent answer questions about HR policies?
Yes, at depth 1, from the current policy library. Answers should cite the policy, and anything about how a policy applies to a specific dispute or complaint should go to HR.