The 2026 pitch is an agent that "runs HR for you". Some of that is real and useful. Some of it puts a probabilistic system in front of a statutory calculation. Here is the line, and how to check a vendor is on the right side of it.
An AI agent in HR software is a language model given tools — read the employee record, draft a letter, file a leave request, run a report — and some autonomy to chain them. That is genuinely useful for the work that is language: drafting the appointment letter from the record, summarising a month of task logs into a review draft, answering "how many casual leaves do I have left and what is the policy on carrying them forward". It is the wrong tool for the work that is arithmetic and rules: computing pay, applying loss of pay, PF on the new ceiling, bonus, TDS — because a model is probabilistic, a payslip is not allowed to be, and "it was right 99% of the time" is a payroll error every month in a 100-person company. The small-business rule: models draft, humans decide, code calculates. Below is where each belongs and the gates to insist on. Facts checked 14 October 2026.
The earlier guide on AI in HR software covers where plain statistics beat a model; nothing in the agent era changed that — time estimation from your own history is still a similarity model, not an LLM.
A payslip is a contract performed. The gross, the LOP for 2 absent days on a 30-day month, the professional tax by state slab, the PF on wages capped at ₹25,000, the TDS averaged over remaining months, the arrears from a backdated hike — every one has a right answer that can be tested and reproduced. A language model generating or "checking" that number introduces a failure rate into a process that previously had none, and the failure is silent: a plausible figure, slightly wrong, on a document the employee trusts.
The same applies to attendance status, leave balances, gratuity, bonus, notice recovery and SLA availability figures. The agent may call the function that computes these and display the result; it may not compute, estimate or round them itself. Ask any vendor: "Is the number on the payslip produced by code, or by the model?" The answer should be immediate.
| Off by default | No AI feature runs on your data until you turn it on. |
|---|---|
| Per-feature switches | Review drafts on, quote drafts off — not one master toggle. |
| Per-tenant opt-in | Your workspace's data is never used unless you opted in; never used to train. |
| Call cap | A monthly limit so a loop or an abuse cannot run up cost or exfiltrate at volume. |
| Human in the loop for actions | Drafts are drafts; approvals, sends and changes are clicked by a person. |
| Logs | Every call recorded: who, what data, which feature, when. |
| Key handling | Provider keys encrypted at rest; the browser never sees them. |
| Data boundary | Which provider receives what, under what retention terms — written down. See the security checklist and DPDP. |
"AI features in our HR and payroll systems may draft documents, summarise records and answer questions from our written policies. They do not compute pay, deductions, balances or statutory amounts, and they do not approve, send or change anything without a named person's confirmation. Features are enabled individually by the admin, logged, and reviewed quarterly. Employee data is not used to train any model." Put it in the handbook next to the data policy; it is the paragraph an employee, an auditor and a vendor each need to read.
| Agents should | Draft, summarise, answer policy questions with citations, triage reversible items |
|---|---|
| Agents should not | Compute pay, deductions, balances or statutory amounts; take irreversible actions alone |
| Rule | Models draft, humans decide, code calculates |
| Failure modes | Confident wrong answers; cross-employee data access; prompt injection; model drift |
| Gates | Off by default; per-feature; per-tenant opt-in; call cap; human approval; logs; encrypted keys |
| Access control | Enforced in the database, not by the model's instructions |
| Policy | One paragraph in the handbook; reviewed quarterly |
An AI agent can prepare, explain and route payroll work, but the calculations — gross, loss of pay, PF, professional tax, TDS, arrears — must be produced by deterministic code with tests, not by a language model. A model is probabilistic; a payslip has one right answer. Let the agent call the calculation and show the result, never compute it.
Language tasks: drafting letters, policies and review summaries from the record; summarising a month of task logs; answering employee questions from your own written policies with citations; and low-stakes triage such as tagging or routing. In each case a person reviews the output before it has effect.
Confident wrong answers presented as fact, access to other employees' data when access control is enforced by prompts rather than the database, prompt injection from documents and emails the agent reads, and drift when the vendor changes the underlying model. Each can be tested before you turn a feature on.
No. Approvals, sends, salary changes and terminations are irreversible or consequential and should be clicked by a named person. An agent can prepare the approval with the relevant balance and policy clause, and a human confirms.
Whether AI is off by default and switchable per feature; whether your data is used only with your opt-in and never for training; whether there is a monthly call cap; whether every AI call is logged; how provider keys are stored; whether access control is enforced in the database; and whether any number on a payslip or balance is produced by the model.
Only if the vendor can show the data boundary: which provider receives what, under what retention terms, with your opt-in, encrypted in transit and at rest, and with the ability to turn it off. Sending employee records to a model provider is processing you are responsible for as the data fiduciary.
Merik is built on the line this guide draws. Payroll is computed server-side by deterministic code from the attendance already recorded; no model touches a payslip figure. Time estimates come from a local similarity model over your own task history, not an LLM. AI features are optional and off by default, behind one server-side function with four fail-closed gates — a master switch, a per-feature flag, a per-tenant grant and a monthly call cap — and provider keys are stored as AES-GCM ciphertext. What the AI produces are drafts only: performance-review summaries from logged work and quote drafts, always edited by a person before they go anywhere.
Access to employee data is enforced by row-level security in Postgres, so an assistant cannot read what the signed-in user cannot. Merik does not offer an autonomous agent that approves, sends or changes records. See security and the modules.
Free, set up for you, every module included — see what the free workspace includes
Where a language model earns its place — and where it must not go.
The questions to ask any HR tool holding your salaries and IDs.
Reviews grounded in the work already logged, not in memory.
Request your free company workspace and bring employees, attendance, leave, payroll and tasks together.