Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can an AI Agent Run Payroll in Gusto Without Seeing Social Security Numbers?
No. Gusto's help page makes the Social Security number an employer-maintained field and does not describe it being masked or replaced before a payroll agent reads the employee record, so a scoped run still needs tokens, a named approver and a record.
A payroll run is a deadline, a set of hours, a set of adjustments and a submit button, and a finance team can hand the whole sequence to an agent without opening an employee's personal information. The personal-information page is separate, and it is where the employer maintains the legal name and the Social Security number, according to Gusto's help page (Gusto, 2026). That separation is real and useful: an agent that stays on the run screens handles pay data rather than identity data. It is also narrower than the access most agent deployments receive, because the same payroll administrator account that submits a run can open the record behind it. A model reads the page it is shown, not the subset of fields the task description names. An SSN is not a seasonal value; it follows the employee across jobs, tax filings and credit, so a copy in a model's context outlasts the pay period. The record here is a Gusto run beside a Gusto profile, and the value at issue is the one that has to be replaced before the model reads the page, not a field a prompt can be told to ignore.
Key findings
- For a Gusto payroll agent to keep the SSN out of its context, the personal-information page would have to render a consistent token such as SSN_001 before the model reads it, with the real number released only at the approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving the run and each record change, plus a record of what the model received, because approval governs the action and not the values already in context (What Is the Difference Between Approving a Credential and Approving Its Use?).
- Gusto's help page does not state how an SSN appears to an administrator or to an agent, and it describes no replacement of the value on the page before a model reads it (Gusto, 2026).
- The same page names "Your legal name" and "Social Security Number (SSN)" as fields "Your employer must update" (Gusto, 2026).
- Maryland's hire job aid says "Enter the nine-digit Social Security Number in the Identification # field," putting the number in front of whoever runs the hire (Maryland Department of Budget and Management, 2022).
- A third-party ADP payroll walkthrough lists Name, Department, Rate, Regular Hours, Salary Amount and other pay fields among the columns to review, with no SSN column (Docsie, n.d.).
What does a Gusto payroll run show the model?
The run itself is a table of pay data. A third-party walkthrough of ADP payroll tells the operator to "Review the following columns for each employee," listing Name, Department, Rate, Regular Hours, Salary Amount and other pay fields (Docsie, n.d.). An agent that reads the run table and nothing else receives names, hours, rates and amounts.
That narrower read is fragile. Gusto's help page warns that "If you update your bank info after payroll is submitted but before payday, funds may go to your old account," an exception that can send an operator back into the employee record during a live run (Gusto, 2026). An agent asked to fix that exception needs the page that holds the bank details, and the same payroll account can open the page that holds the SSN. The task's scope and the session's scope are different permissions.
A reviewer can see the difference in one run. Give the agent the run table and a submit step, then check whether any step opens a profile. The run screen is the right place to start scoping, and it is not proof that the number stayed out of the model's context. The same distinction applies to a computer-use agent on a customer record (How Do You Run Claude Computer Use on Customer Records Without Exposing PII?).
What does a Gusto employee profile show the model?
The personal-information page is where the identity fields live. Gusto's help page says "Your employer must update these details for you" and names "Your legal name" and "Social Security Number (SSN)" among them, while the same page lets an employee "add up to 5 bank accounts and split pay between them" and requires a "security check (2-step code and confirm current bank)" (Gusto, 2026). Those controls govern edits, not what the page shows.
The page is explicit about the employee's side and silent about the administrator's view. It does not state how an SSN appears to an administrator or to an agent (Gusto, 2026). That silence matters because the value is employer-maintained, so the employer's session can reach it. If the page draws the number, the model receives it. If the product masks it, the vendor's page does not record that behavior.
The distinction is not academic. An administrator may need the SSN to correct an employee record, while the agent needs only enough to match the person. A product that shows the number to one and not the other is enforcing two views, and the Gusto page describes neither.
The Social Security Administration's consumer guidance is a reminder of what the value carries: "You should be careful about sharing your number, even when you're asked for it" (Social Security Administration, 2026). A payroll agent is a new asker.
What do the vendors themselves say?
Three pages document the field each product shows an operator. Gusto's help page names "Your legal name" and "Social Security Number (SSN)" as employer-updated details and does not state how the SSN appears to an administrator (Gusto, 2026). Maryland's hire job aid says "Enter the nine-digit Social Security Number in the Identification # field" (Maryland Department of Budget and Management, 2022). Infinite Campus's catalog says "All SSNs initially display as XXX-XX-XXXX" and requires SSN rights to view the number, a display rule the payroll pages do not describe (Infinite Campus, 2026).
| Source | What its page documents | What a buyer should verify |
|---|---|---|
| Gusto | Employer-updated legal name and SSN; five bank accounts per employee; a security check on bank changes | Whether an administrator's view masks the SSN and what an agent signed in as that administrator receives |
| Workday (Maryland job aid) | Hire Details fields; a nine-digit SSN entered in the Identification # field; a duplicate alert | Whether the SSN field is masked after entry and what a model reading the hire screen receives |
| Infinite Campus | SSNs initially display as XXX-XX-XXXX; SSN rights are required to view the number | Whether the masking applies to the rendered page or only to the stored field, and which roles can unmask it |
The table separates a display rule from a permission rule. Infinite Campus documents the first; Gusto documents who may edit the number, not how it is drawn. An edit control is not a display control.
Where do scope, approval and the record separate the two?
Permissions decide which pages an agent can open. Approvals decide which actions it can take. A record decides what a reviewer can reconstruct. Only the first can keep the SSN out of the model's context, because a permission can prevent the profile from opening at all.
The record and the default approval are uncommon across the agents a review read, which did not include Gusto's payroll product: 5 of the 15 document a per-action record an administrator can export, and 1 documents asking a person by default before every consequential action (Do AI Agents Ask Before Making a Payment?).
AWS's guidance makes the record point directly: "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). That is an action log, not a record of what the model saw. The FBI's payroll-diversion notice shows why the distinction matters: criminals "target employees through phishing emails designed to capture an employee's login credentials" and then add rules that stop alerts about direct deposit changes (FBI Internet Crime Complaint Center, 2018).
Prompt injection research says the same. CaMeL's design goal is that "the untrusted data retrieved by the LLM can never impact the program flow" (Debenedetti et al., 2025), a property built into the system before the model reads. EchoLeak showed a production assistant whose client "automatically fetches the external image URL included by the attacker," a zero-click path from content to exfiltration (Reddy and Gujral, 2025). The separation appears in Can an AI Agent Approve Bills in Bill.com Without Seeing Bank Details?.
What should a finance team ask for in writing?
The first question is which screens the agent may open. Ask for the list in writing: the run table, the submit step, the personal-information page, the bank page, any exception view. A run-only task should name the screens it needs; an account that can open every screen is a different grant.
The second question is what the model receives from the rendered screen. Ask whether the SSN is replaced with a consistent token before the model reads the page, whether the token holds across every screen in the run, and where the real value resolves. An administrator's view is not the model's view.
The third is who approves. Ask for a named person, the action they approve, and the evidence the approval leaves. The fourth is the record: what the model received, what the agent did, and who approved, exported to the team's own monitoring. A vendor's assurance that the run is audited does not answer the first two questions.
A finance team can put these in a short questionnaire and attach it to the vendor review. The answers should name the screen, the field and the approver, and the team should test one run against them. What Happens When an AI Agent Sees Employee Salaries? shows the same questionnaire applied to a compensation screen, where the identity fields and the pay fields sit together.
What does a governed environment change?
A governed environment moves the control to the point where the page is drawn. Values chosen by policy are replaced with consistent tokens before any model reads the screen, so the personal-information page can render SSN_001 where the number sits, and the bank page can render ACCT_001. The tokens hold for the whole run, and real values resolve only at an approved destination, at the moment of an approved action. A named person approves every payment, submission and record change, and the environment exports a record of each one.
A run-only task that never opens the profile may never need the number. A task that follows an exception into the profile reads SSN_001 instead of the number. The control does not depend on the agent ignoring a field; it changes what the page hands the model (What Is Render-Layer Tokenization?).
The evidence on utility loss points the same way: Does Masking Data on Screen Break Browser Agents? reports that replacing identifiers with consistent pseudonyms and restoring them afterward reduces semantic utility errors by a factor of five compared with baseline techniques. The scope is the rendered page, so a value pulled through a direct API call is outside it (What Is an Approved Destination for AI Agent Output?).
What the record shows
A payroll agent reads the page it is given, and the page that carries the Social Security number is the employee record, not the run table. The vendor pages reviewed draw a clear line around the run: its columns are pay data, and the identity fields sit on the employer-maintained page (Docsie, n.d.). Neither page states that the number is replaced before a model reads the screen, so an agent with account-level access can receive it on the profile (Gusto, 2026). A team can check this on one run: name the run screen and the profile, give the agent the run task, then compare what the model received with what each screen rendered. The payroll team should run that comparison as a test before the agent works a live run.
Methodology and limitations
Vendor and knowledge-base pages were read as of October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control. The page rests on Gusto's help page, a state Workday job aid, a student-information-system tool-rights catalog, a third-party ADP walkthrough, federal guidance and a vendor audit-log note. The walkthrough is not ADP documentation, and the state job aid is a 2022 guide whose screenshots carry OCR text.
No product on this page was tested for this page. "Not described in the pages reviewed" means those pages. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a Gusto run beside a profile, not an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot on the organization's own screens.
Frequently asked questions
Can an AI agent run payroll in Gusto without seeing Social Security numbers?
No, not from the pages reviewed. Gusto's help page puts the SSN among the fields the employer updates and does not state how an administrator or an agent sees it. A run scoped to the pay table may render names, hours, rates and amounts without the number, but the payroll account that submits the run can open the record behind it, and nothing in the page replaces the value before a model reads the screen. That is the gap a buyer has to test.
What does the Gusto run screen show for each employee?
Not an SSN in the run columns the recorded walkthrough lists for employees: Name, Department, Rate, Regular Hours, Salary Amount and other pay fields, with no SSN column (Docsie, n.d.). That walkthrough covers ADP, not Gusto, so it describes a typical run rather than a Gusto screen. Gusto's help page covers the personal-information fields and does not show a run table at all in practice.
Who can change an SSN in Gusto?
The employer. Gusto's help page says "Your employer must update these details for you" and names "Your legal name" and "Social Security Number (SSN)" among them (Gusto, 2026). An employee can add up to five bank accounts and split pay, but a bank change requires "Complete the security check (2-step code and confirm current bank)" (Gusto, 2026). Those rules govern who may edit the record, not what the record shows the model.
Does scoping the agent to the run screen remove the exposure?
Only partly. A task that stays on the run table reads pay data and may never draw the SSN, which is a smaller read than an administrator's session. The scoping is a permission on the task, and the session behind it can still open the personal-information page. Without a documented rule that replaces the number before the model reads that page, the narrower task lowers the chance of exposure rather than closing it.
Who should approve a Gusto payroll run?
A named person with authority over that payroll, not the operator who launched the agent. An approval in front of the submit step governs the action; it does not change the rows the model received when the run and profile pages loaded. The approver should see the run total and the employee record behind any exception, and the approval should be recorded against that specific action.
What record should a finance team keep after an agent runs payroll?
One that shows what the model received, what the agent did and who approved. An action log answers only the middle question. The record needs the run screen and any profile screen as the model saw them, the action submitted, and the name of the person who approved it, exported to the team's own monitoring. A reviewer can then compare the rendered page with what the model held.
How RedactSure Keeps Social Security Numbers Out of a Payroll Agent's Context
A Gusto agent that submits a run can also open the employee record holding the Social Security number, and permission does not change what the page draws. Gusto's help page puts "Social Security Number (SSN)" among the fields "Your employer must update" and does not state how an administrator sees it (Gusto, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the profile renders the SSN and bank details, and the model can carry them into a summary. Inside: the same page renders SSN_001 and ACCT_001, the run renders EMP_014, and real values resolve only at the payment or record change a named person approves; every screen and approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A Gusto run can stay on the run table while the profile behind it still holds the number. Bring one payroll task and see, with test values, what the model reads, who approves the change and what the record keeps. Book a demo