Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Who Approves an AI Agent's Payroll Run?
The payroll manager does, on the submit, from a preview that shows the run's totals and exceptions rather than every salary. Ask what the model received on the entry screen, who signs off, and what the record shows the approver released.
Payroll approval has always been a page with a name attached. A manager opens the preview, reads the totals, checks the exceptions and submits, and that signature is what turns a prepared run into the company's decision to pay. An agent that prepares the run does not move the signature, but it adds a question the older workflow never had to ask: what the model read on the way to the totals. The sign-off stays with the payroll manager at the submit, and the preview that manager reads should carry the run's totals and exceptions without exposing every salary. Two conditions follow. The run has to reach the approval step with a named person attached, and the screen that person reads has to carry enough to decide without carrying every employee's pay and bank account. The record then has to answer both halves, what the agent saw and what the approver released. The approval is a decision about a submit, and the fields a person needs to make it are not the fields a model needs to prepare it. A payroll manager should check whether a given tool does that on its own pages rather than its feature list, and those pages usually answer it in pieces.
Key findings
- For an agent to prepare a payroll run, the values on the entry and preview pages would have to be replaced with consistent tokens before any model reads them, with the real amounts resolving only at the approved destination, the submit (What Is Supervised Delegation?).
- It would also require a named person approving that submit and a record of what the model received and what that person released, a decision with an owner rather than a confirmation prompt (What Is an AI Control Record?).
- None of the payroll pages reviewed describes an approval that shows the approver totals and exceptions without exposing every salary, and each documents the preparer's screen rather than what the model receives on it (Docsie, 2026).
- The payroll guide tells the preparer to "Review the following columns for each employee", lists Salary Amount among them, and after the preview offers a warning dialog with "Choose Ignore Issues to proceed without changes" (Docsie, 2026).
- Workday's administrator guide puts payment elections behind security domains that include "Worker Data: Payroll (Payment Elections)", and it describes no approval step before an administrator changes an employee's bank account (Workday, 2026).
- The AI Agent Index entry for Breeze Agents records that "The default is that approval is required," but users can switch it off and automatically triggered agents then run without approval, which makes approval a setting rather than a named person (AI Agent Index, 2026).
Who approves an AI agent's payroll run?
The approval belongs to the payroll manager, and it happens at the submit. The payroll guide's preview lists the columns a preparer checks and offers a dialog to ignore the flagged issues or go back and fix them (Docsie, 2026).
The delegation question comes first. MIT Sloan's analysis defines agents as systems that "perceive, reason, and act in digital environments to achieve goals on behalf of human principals" (MIT Sloan, 2026), and a payroll submit is one of those goals. Research on agent design adds the constraint: once an agent ingests untrusted input, "it must be constrained so that it is impossible for that input to trigger any consequential actions" (Beurer-Kellner et al., 2025). A named person at the submit is that constraint, and the position paper on autonomy argues that "fully autonomous AI agents should not be developed" (Mitchell et al., 2025).
A manager handed the full entry grid can approve, but only by reading every salary and every bank account (What Is Supervised Delegation?). A manager handed totals and exceptions can approve without seeing individual figures. Separation of duties adds the second condition: whoever prepares the run should not be the only person who releases it (Do Coding Agents Break Separation of Duties?). An agent that prepares and submits in one step has collapsed both roles.
The payroll manager's signature at the submit is the design, and only 1 of the 15 AI agents reviewed documents asking a person by default before every consequential action; the payroll products here were outside that review (Do AI Agents Ask Before Making a Payment?).
What does the approver see, and what does the model receive?
Two screens decide this question, and they are usually not the same screen. The approver reads a summary: the run's total, the change from the last run and the flagged exceptions. The model that prepared the run read the entry grid, and if it assembled the payment file it read the account fields. Workday's administrator guide describes the second kind of page: payment elections are governed by security domains that include "Worker Data: Payroll (Payment Elections)" rather than by a summary view, and when bank details change "Workday automatically updates all payment elections" (Workday, 2026). Rendered to an agent preparing a whole run, that page puts every account number in front of the model.
The approver needs the totals, the exceptions and the count; the model needs the hours and rates to compute them. Where the two views are the same page, the approver's screen and the model's context are the same object.
For payroll the question is whether the preview can reach the approver as totals while the model works from tokens. An agent with access to financial records can act beyond what the person intended unless a check sits between the reading and the release (Is It Safe to Let AI Agents Access Financial Records?), and an approval is that check only when the person signing can see what they are signing (What Should I See Before Approving an Agent's Access to a Credential?).
What do the vendors themselves say?
Three vendor pages bear on the approval question, and none names who approves the run.
The payroll guide follows the preparer through entry and preview, and its column list for each employee includes Salary Amount (Docsie, 2026). Its limit is the role it addresses: the dialog checks whether the numbers look right and names no approver.
Workday's payment elections page states that when bank details change "Workday automatically updates all payment elections with the new account information", and it governs the change through security domains that include "Worker Data: Payroll (Payment Elections)" (Workday, 2026). Its limit is the missing step: the page describes no approval before an administrator changes an account, so the control is who holds the domain.
Chase's business banking overview is explicit about approval, and it offers to "Set daily transaction limits and approval thresholds" and to "Require a second approver on transactions with Dual Control" (Chase, 2026). Its limit is scope: those settings govern money leaving the bank account, and they say nothing about the payroll file that was approved before the file reached the bank.
| Dimension | What the page documents | What a buyer should verify |
|---|---|---|
| Preparer's screen | A preview and a warning dialog (Docsie, 2026) | Whether a preview can be approved on totals without showing each salary |
| Account changes | Security domains govern who edits a payment election (Workday, 2026) | Whether a second person approves a bank account change |
| Payment release | Daily limits, approval thresholds and dual control (Chase, 2026) | Whether a run inherits those limits or reaches the bank without them |
The ServiceNow page reaches the same point on configuration: in Supervised mode the AI agent action requires user input or approval to run (Does ServiceNow Let AI Agents Change Records Without Approval?). That places the human step at the action's mode, which settles that an approval happens and leaves open who gives it.
What does the approval record contain after a payroll run?
A record that answers this question has two halves, and most payroll systems keep only the second. The second is the approval: who released the run, when, and what total that person released. The first is what the model received before the decision, and payroll audits rarely hold it.
Research on visibility proposes "agent identifiers, real-time monitoring, and activity logging" for agents generally (Chan et al., 2024), and each maps onto a line the record needs: which agent prepared the run and which pages it read. A log of actions is not a capture of the screen the model read, and the difference matters. Chase's portal lets a business "Search for activity by user, accounts and transaction types" (Chase, 2026), which answers who did what inside the bank and leaves open what the preparer's model was shown.
Accountability is the reason to keep both halves. A tribunal held that "It should be obvious to Air Canada that it is responsible for all the information on its website" (Moffatt v. Air Canada, 2024), and the reasoning attaches to a payroll run the company submitted, whoever prepared it. A named person at the submit is how the company shows who answered for the release (Who Approves an AI Agent's Claim Payment?). The record makes that name checkable afterward (What Is an AI Control Record?).
For example, a run approved on totals leaves a short record: the tokenized preview the model worked from, the totals the approver read, the name at the submit and the destination that received the real values.
What does a governed environment change?
A governed environment moves the control to the render layer, the point where a page becomes what a model reads. Values chosen by policy are replaced with consistent tokens for the whole run, so an agent preparing a payroll run works on EMP_014 and ACCT_007. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. Real values resolve only at the approved destination, at the moment of an approved action, so account numbers reach the payment file the approver released and not the transcript. A named person approves each submit, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
For this page's question the change is what the approver can be shown. The preview can reach the approver as totals and exceptions while the model's view of the same run carries tokens, so the person signing does not read every salary and the model does not hold one. That combination is what the payroll pages reviewed leave open, and it is the difference between an approval that decides and a dialog that confirms.
The control class is illustrated by the comparison with Microsoft Agent 365, which governs agent access across an estate rather than the values on one rendered screen (RedactSure vs Microsoft Agent 365).
What the record shows
What the model receives on the screen, who approves the submit and what the record holds are the three facts that settle a payroll delegation, and the dialog a preparer clicks answers none of them. An approval that runs on totals keeps the decision separate from the individual figures, and the pages reviewed support that shape in parts: the payroll guide documents the preview and the warning, the administrator guide documents who may change a payment election, and the banking page documents approval thresholds and dual control. What none documents is a preview that carries totals to the approver while the model works from tokens, or a record of both the screen read and the name at the submit. A reader can test this on one run: ask the preparer what the model read and the approver what they saw, and compare. If both describe the same grid, the approval was a confirmation and not a decision.
Methodology and limitations
This page rests on the payroll guide's description of the entry and preview steps, Workday's administrator guide for payment elections, Chase's business banking overview, the AI Agent Index entry for Breeze Agents, three research preprints on agent design and visibility, and a law firm's analysis of a decision. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page.
The products on this page are described from documentation and none was tested for this page; "not described" means the pages reviewed. The example describes a record type, a run approved on totals, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations about whether a payroll approval meets a control requirement belong to counsel, assessors and the organization's own security and compliance officers.
One limit belongs to these sources: the payroll guide is a third-party tutorial with 2022 screenshots, not ADP's documentation, so it is cited for the flow's shape and the column names.
Frequently asked questions
Who approves an AI agent's payroll run?
The payroll manager does, at the submit, and the approval should turn on the run's totals rather than on a reading of every employee's pay. The payroll guide documents a preview and a warning dialog for detected issues, and neither names an approver (Docsie, 2026). The approver needs the total, the exceptions and a count, plus a record of what the model read before the preview was drawn. Otherwise the signature sits on a screen the preparer could have changed.
Can an agent prepare a payroll run without seeing salaries?
Yes, when the screen is rendered to the model as tokens and the real amounts resolve only at the submit. The run still needs hours, rates and exceptions, so those figures stay real on the rendered page while the employees' names and account numbers render as tokens such as EMP_014 and ACCT_008. The approver then reads totals rather than individual figures. The arrangement needs a destination that resolves values on an approved action and a record of which screens the model read.
What should the approver see before releasing a run?
The total, the change since the last run, the employees with no hours, the exceptions flagged and the count of payments. What the approver should not need is every salary and every bank account, because the decision is about the run. The preview the payroll guide describes lists Salary Amount for each employee (Docsie, 2026), so an approval built on it puts every salary in front of the signer.
Does dual control at the bank approve the payroll run?
No. Dual control approves a transaction that reaches the bank, after the payroll file has been prepared and released. Chase lets a business "Require a second approver on transactions with Dual Control" (Chase, 2026), and that approver sees a payment, not the run that produced it. The payroll decision has to happen earlier, at the preview, with a named person who sees the totals and a record of what the model read.
What record should a payroll run leave?
One that pairs what the agent saw with what the approver released: the tokenized screens the model worked from, the totals and exceptions the approver read, the name at the submit and the destination that received real values. Activity logging alone does not answer it, because a log of actions does not show the fields in front of the model. Ask for the screen, the totals and the name in one export.
Is an approval setting the same as a named approver?
No. A setting decides that an approval step exists; it does not put a person's name on the release. The AI Agent Index entry for Breeze Agents records that "The default is that approval is required," and that users can switch it off, after which automatically triggered agents run without approval (AI Agent Index, 2026). A payroll control that can be switched off is a configuration, and accountability needs the name.
How RedactSure Keeps Salaries Out of the Approval Itself
A payroll approval that makes the approver read every salary has already shown more than the decision needs.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent reads the entry grid with each salary and account number legible. Inside the governed environment, the model works a run of EMP_014 and ACCT_007 while the preview reaches the approver as totals and exceptions, and the real values resolve at the payment file the named person approved.
RedactSure is deploying now with enterprise and government customers. Workday's payment elections page describes no approval step before an administrator changes someone's bank account.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A payroll run approved on totals separates the decision from the grid it came from. Bring one run from your workflow and see, with test values, the preview the model reads, the totals the approver releases and the record both leave. Book a demo