Permission-scoped AI over live HR data

The problem

HR data is among the most sensitive a company holds. An assistant answering questions on pay, attendance and leave must inherit the user's permissions, never bypass them, and never invent a figure.

Multi-tenant SaaS; one tenant's people are invisible to another.

The model may only call tools the signed-in user's permissions and scope allow.

Payroll and personal figures must come from platform services, not from the model.

A write action requires explicit confirmation; drafting is not submitting.

System architecture

flowchart LR
  subgraph access ["Access"]
    access_0["Signed-in user"]
    access_1["Permission scope resolution"]
  end
  subgraph orchestration ["Orchestration"]
    orchestration_0["Tool allow-list for model"]
    orchestration_1["HR service calls"]
  end
  subgraph assurance ["Assurance"]
    assurance_0["Figure guard on synthesis"]
    assurance_1[("Tool-call audit store")]
    assurance_2["User confirmation for writes"]
  end
  access_0 --> access_1
  access_1 --> orchestration_0
  orchestration_0 --> orchestration_1
  orchestration_1 --> assurance_0
  orchestration_1 --> assurance_1
  assurance_2 -->|"approved writes only"| orchestration_1

Interaction schematic

Schematic of the interaction described above. Generic interface, no real data, no measured figures. Not a product screenshot.

Key architecture decisions

Permissions resolve before the model sees a tool

The user's permission scope is resolved first; tools outside it are not offered to the model at all.

Filtering the answer afterwards still leaks through the model's reasoning. A tool it cannot see, it cannot call.

Rejected Post-hoc redaction of model answers — rejected for payroll and personal data paths.

Trade-off Scope is recomputed for every conversation and must stay in step with the permission system.

The model may not invent a number

Answers are synthesised from tool results; a figure no tool returned sends the answer back to the tool summary.

In payroll, a confident wrong number is worse than a plain refusal.

Rejected Free-form model answers on numeric HR fields — rejected after figure drift in testing.

Trade-off Some answers read plainer than a chatty assistant would prefer.

What I own, wrote, and delegate

Own

Permission scope before tool exposure to the model
Audit trail on every tool call and confirmation gate on writes

Wrote

Orchestration layer wiring LLM tool calls to existing HRM services
Figure guard that rejects synthesis when a number was not returned by a tool

Delegate

Core payroll calculation engines maintained by domain specialists

Scale

Governed tools grouped by scope: personal HR self-service, team manager views, and company-wide HR operations
Tool families include leave balance and requests, attendance, payslip retrieval, and team roster queries

Boundaries

Each role sees a different set: personal, team, or company. A single tool count would hide that split.
Model vendor and prompt templates are operational detail; the security model is permission-first, not prompt-first.

What we watch in operation

Tool-call latency and failure rateSynthesis fallbacks on figure driftAudited usage by tenant and scope

Rules the design never breaks

The assistant cannot call a tool outside the user's permission scope.
One tenant's data is never visible to another.
No leave request is submitted without explicit confirmation.

Broader application

Enterprise products where an assistant must respect existing role permissions.
Sensitive data — pay, absence, personal records — answered from source systems.
Workflows where drafting is automated and commitment stays human.