Start read-only and narrow. Give the agent access to the pay records and runs its job needs, without sickness reasons or other health detail, and let it draft changes into the payroll system's approval queue at depth 2. Bank detail edits, run approval, tax filings and payment release stay with named people. Enforce this in the payroll system's permissions, not in the agent's instructions.
What does the connection involve, and who owns it?
A payroll system holds some of the most sensitive data a company has: salaries, bonuses, tax details, bank accounts, deductions, and often absence records that hint at health. It also produces payments that leave the business on a fixed date and are awkward to recover. An agent connected to it can save the payroll team hours each cycle, mostly by checking and preparing, but only if its access is cut tightly to the job.
The payroll manager owns the system, its roles and the agent's grants. HR owns employee records. The data protection owner must approve what personal data the agent may read. A finance director or equivalent approves each run. The wider finance position is in AI agents for finance: books you can audit.
Which permissions should you grant, and at what depth?
| Action in the payroll system | Depth | Condition | Stays with a person |
|---|---|---|---|
| Read pay elements, runs and change history | 1 | Entities in scope | Nothing |
| Read bank details | 1 | Masked except for change checks | Nothing |
| Read absence reasons and health notes | None | Refused by your limits | HR and payroll |
| Run standard reports | 1 | Approved report list | New reports |
| Draft changes into the approval queue | 2 | From an approved source | Approval |
| Enter changes directly | None | Refused by your limits | Payroll team |
| Edit employee bank details | None | Refused by your limits | Payroll team after verification |
| Approve or finalise a run | None | Refused by your limits | Run approver |
| Submit tax filings | None | Refused by your limits | Payroll manager |
| Generate or release payment files | None | Refused by your limits | Payment authorisers |
Most of the useful work sits in the first and fifth rows. Reading lets the agent check every change before a run, as set out in checking payroll changes before the payroll run. Drafting lets it turn an approved HR change into a pending payroll entry that a payroll officer reviews and accepts.
Why enforce it in the system, not the instructions?
An agent's system prompt can say "never change salaries". That is a request, not a control. If the payroll role allows salary edits, a confused brief, a crafted input or a simple mistake can still produce one. The term is explained in what is a system prompt; the point here is that it sits on the wrong side of the boundary. The permission should be missing in the payroll system, and the platform should refuse the action, so that both the system and the verdict record show the agent could not do it.
The same applies to salary changes specifically. Whether an agent should ever make them is discussed in can an AI agent change an employee's salary in payroll. Our view is that it should draft them from an approved HR record and a person should accept them.
How do you set it up, step by step?
- Person, data protection owner: approves the data scope. Which fields the agent may read, and why. Absence reasons and health notes are excluded.
- Person, payroll manager: creates a dedicated payroll user with the reads and the draft-to-queue right only. If the system cannot separate drafting from entering, keep the agent read-only.
- Person: masks bank details in the agent's view, except the fields needed to detect duplicates and recent changes.
- Person: sets the agent's limits in Pryme to match.
- Agent, depth 1: runs read-only for a full cycle, checking changes and reporting what it would have drafted.
- Attest: replays past cycles and scores checks and drafts against the floor.
- Person: enables drafting when the certificate is issued.
What is recorded for each action?
Every read of a pay record, every report run and every draft is filed as a verdict: the employee or run, the fields accessed, the bounds checked and the one that decided. Reads are worth recording here more than in most systems, because payroll data is so sensitive. If an employee asks who has looked at their pay record, you should be able to answer, including for the agent.
The payroll system's own audit log should show drafts under the agent's user and acceptance under the payroll officer's. A change accepted without a matching draft verdict means someone entered it directly, which is normal, but the record shows who.
How do you revoke access?
Remove the drafting right and the agent returns to checking only. Disable the payroll user to stop everything. A certification run that clears no depth drops the agent to depth 1 the same day. Because payroll runs on deadlines, decide in advance who covers the checks if the agent is stopped close to a run, and test revocation outside the run window.
What stays with a person?
Bank details, approval, filing and payment, without exception in most organisations. These are the points where fraud happens and where errors cost real people money on payday. Whether an agent could ever run payroll end to end is argued in can an AI agent run payroll.
Where does it usually go wrong?
The payroll role is copied from a payroll officer. It includes direct entry and bank edits. Build from the job instead.
Health data leaks in through absence. Sick pay codes reveal more than they seem to. Exclude reason fields and give the agent only what it needs to check pay.
Self-service questions widen access. Employees start asking the agent about their own pay. That is a separate capability with verification and a strict "own record only" bound.
Integrations multiply. Payroll often connects to HR, finance and procurement. Keep each connection separate; the procurement setup is described in connecting an AI agent to your procurement system.
Questions people ask
Can the agent reconcile payroll to the general ledger?
Yes, with read access to both. It drafts any adjusting journals for an accountant to post.
Should the agent see salaries at all?
If it checks changes, yes. Limit who can read its outputs and keep its exception lists inside the payroll team.
What about payroll for several countries?
Grant per country or entity. Rules, filings and deadlines differ, so certify each separately.