HR advisers approve the agent's drafts and routine record updates. Changes to pay or contract terms need an HR business partner plus a second approver from payroll or finance. Outcomes of disciplinary, grievance or dismissal processes are never prepared for one-click approval: a person decides and writes. Nobody approves a change to their own record, and rights lapse with certificates.
What does an HR approver rule govern, and who owns it?
HR teams use agents to answer policy questions, draft letters, keep records current and prepare paperwork for changes such as new hours or a new role. That work touches personal data, some of it special category, and decisions with serious effects on people's livelihoods. The approver rule decides who may release each held action.
The HR director owns the rule. The data protection lead and employment counsel review it. The agent owner configures it. Our explainer on what an agent approver is sets out the role, and our guide to AI agent skills by role covers what HR advisers need to know.
What are the steps?
- HR director: lists the agent's actions by depth. Depth 1: reads HR records and policies the employee is entitled to see. Depth 2: drafts letters, contract variations, offer letters and replies to complex queries. Depth 3: answers routine policy questions, books meetings, updates non-sensitive personal details such as an address after verification. Depth 4: changes pay, hours or contract terms in the HR system.
- HR director: assigns depth 2 approvals to HR advisers, who read and send in their own name.
- HR director: assigns depth 4 approvals to an HR business partner plus a second approver from payroll or finance, because pay changes flow straight into the payroll run.
- HR director: removes outcome decisions from the agent's scope. Disciplinary outcomes, grievance findings and dismissals are refused by the agent's bounds; it can schedule meetings and draft neutral process letters only.
- HR director: bars self-approval. No HR staff member approves an action on their own record, or on the record of someone they manage.
- HR director: ties each role to a current certificate. Agent owner configures and files.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Answer policy query | Replies from the policy library | 3 | Complex or sensitive queries |
| Update address | Updates after verification | 3 | Nothing within bounds |
| Draft letter | Drafts for an adviser | 2 | Adviser approves and sends |
| Change pay or terms | Prepares and holds | 4 | HR partner plus payroll or finance |
| Process outcome | Refuses | none | Decision-maker writes and decides |
Why are outcome decisions outside the agent's bounds altogether?
A disciplinary outcome, a grievance finding or a dismissal is a decision with legal and personal consequences. Even a held draft shapes the decision-maker's thinking: once a well-written dismissal letter exists, it becomes harder to decide otherwise. So the rule does not hold these for approval. It refuses them.
The agent can still help with the process: scheduling hearings, sending neutral invitations from approved templates, compiling the documents both sides submitted. The thinking and the writing of the outcome stay with the manager hearing the case and the HR partner advising them. In the EU and UK, data protection law limits decisions based solely on automated processing with significant effects on people, which reinforces the same line.
Health information is special-category data. An agent answering absence queries should be scoped so it does not draw on medical notes unless the policy permits, and requests involving health go to an adviser.
Which controls make the rule work, and what evidence do they leave?
Two approvers on pay and terms. Evidence: two named approvers on each change, matched to the approver authority matrix for the HR team.
Outcome requests refused. Evidence: refused verdicts naming the scope bound when anyone asks the agent to draft an outcome.
No self-approval. Evidence: approver names compared with the subject of each record change.
Verification before detail changes. A new bank account or address given in an email is external. Evidence: provenance and the verification step on each change.
Rights lapse with certificates. Evidence: certificate status on each approval date.
What should you measure?
- Pay changes with one approver. The target is none.
- Refused outcome requests, which show whether managers are trying to shortcut processes.
- Policy answers corrected by advisers, grouped by policy.
- Self-approvals. The target is none.
- Adviser coverage, using the competency matrix for the HR team.
Where does it usually go wrong?
Managers use the agent as an HR adviser. A line manager asks the agent how to handle a performance issue and acts on the answer. Scope the agent to point managers to an HR adviser for anything beyond policy facts.
Offer letters go out with the wrong terms. The agent drafts an offer from the approved salary band, the hiring manager agreed something different on a call, and the adviser approves the draft without checking. An offer letter, once accepted, is hard to take back. The adviser approving it should see the signed-off hiring approval alongside the draft, with its provenance, and send nothing that does not match.
Bank detail changes are treated as routine. Payroll diversion fraud starts with an email from a "colleague". Treat bank changes as depth 4, like the payroll team does.
Fraud team rules are borrowed. Compare the approver rule for the fraud team, which allows fast protective action. In HR, speed is rarely the point.
Support rules are borrowed. Compare the approver rule for the support team: customer goodwill limits have no equivalent in employment decisions.
Questions people ask
Can the agent answer employees' questions about their own pay?
Yes, from the payroll record they are entitled to see, at depth 3 if certified. Disputes about pay go to an adviser.
Can the agent screen job applications?
Screening affects people's access to work and carries fairness risk. Many organisations keep screening decisions with people and limit the agent to scheduling and acknowledgements.
Who sees the verdict record for HR agents?
Only those with a need, under your data protection rules. The record contains personal data and should be protected like the HR system itself.