Skip to content
ThetaLayer

Solutions · People operations

Onboarding and HR agents, held to strict mandates

Onboarding, HR helpdesk and payroll-change agents work with the most sensitive data you hold. ThetaLayer records what each one did across the HRIS, the identity provider and the service desk, checks every field it touched against its mandate, and shows what each completed onboarding cost.

Book a DemoSee the pilot
Evidence from
  • HRIS audit trail
  • Identity provider
  • IT service desk
  • Approvals
  • Applicant tracking
Evidence chain
New-joiner onboarding · onboarding agent
Created worker record
Agent reported
success
HRIS audit trail says
worker record created
ConfirmedLinked by direct reference · 95%
Provisioned accounts
Agent reported
role template applied
Identity provider says
privileged group added — not in template
Out of mandateLinked by business key · 85%
Ordered laptop
Agent reported
success
IT service desk says
request created
ConfirmedLinked by time window · 70%
Access granted beyond the role template
Mandate breach · routed to the access owner before the start date
Illustrative · example run, simulated data

The workflow

From signed offer to day-one ready

Onboarding crosses four or five systems, each with its own audit trail and none with the full picture. ThetaLayer links them into one run per new joiner.

  1. 01
    Applicant tracking
    Offer accepted
    Recorded in
    Applicant tracking system

    Offer status and start date — the trigger for the run.

  2. 02
    Onboarding agent
    Worker record created
    Recorded in
    HRIS audit trail

    Which fields were written, under which identity. Values hashed or dropped.

  3. 03
    Onboarding agent
    Accounts provisioned
    Recorded in
    Identity provider

    Accounts and group memberships, compared with the role template.

  4. 04
    Onboarding agent
    Equipment ordered
    Recorded in
    IT service desk

    Request created and fulfilled, linked on a hashed employee ID.

  5. 05
    Payroll approver
    Pay details set
    Recorded in
    HRIS · approvals

    Bank details and salary entered by a person, with approval — not by the agent.

  6. 06
    Systems of record
    Day-one ready
    Recorded in
    HRIS · identity provider · service desk

    Every step confirmed before the start date — the outcome the run is measured on.

HR helpdesk and payroll-change agents follow the same model: request, action, approval, record — each step tied to its audit trail.

Direct reference
95%
Business key
85%
Time window
70%

What ThetaLayer shows you

What HR teams need to know about their agents

What ThetaLayer is built to detect in onboarding, helpdesk and payroll-change workflows — with field names and actors, never the personal values themselves.

Mandate · Protected fields

Bank details or salary changed by an agent

e.g. an HR helpdesk agent updates an employee's bank account or a pay element directly, where the mandate says those fields need a person and an approval.

Evidence
HRIS audit: protected field changed by the agent · Approvals: none
Mandate · Access

Access granted beyond the role template

e.g. an onboarding agent adds a new joiner to a privileged group the role doesn't include — caught before the start date.

Evidence
Identity provider: group membership vs. role template
Ledger · Delegated identity

Agent work recorded as an HR partner's

e.g. an agent acting with an HR partner's delegated credentials, so the HRIS can't tell agent from human — a gap for audit and for transparency towards employees.

Evidence
HRIS user vs. agent run identity
Ledger · Claimed vs. recorded

Onboarding steps reported done that weren't

e.g. the agent reports equipment ordered, but there's no matching request in the service desk — found before day one, not on it.

Evidence
Runtime: success → service desk: no request
Scorecard · Time-to-ready

Onboardings that stall between systems

e.g. runs waiting days for an approval or an account, measured from offer accepted to day-one ready, by agent and team.

Evidence
Timestamps across applicant tracking, HRIS, identity provider and service desk
Mandate · Read scope

Agents opening records outside their case

e.g. a helpdesk agent answering one employee's question opens other employees' records — where the HRIS logs read access.

Evidence
HRIS read log vs. the case the agent was assigned

Illustrative examples of what ThetaLayer is built to detect — not results from customer deployments.

Data protection

A factual record for your DPO and employee representatives

Agents that act on employee data raise fair questions: what can they change, who approves, and what is recorded about it. ThetaLayer answers with the agent's written mandate and a record of its actions, while personal values stay inside your network.

  • Field names and actors recorded; values hashed or dropped before export
  • Agent identity kept separate from the people it works for
  • Introducing ThetaLayer may fall under your data-protection and works-council processes — we document exactly what is collected, and why, to support that review
Evidence envelope · HRIS change
What leaves your network
Exported, minimized
  • actoragent · onboarding-agent
  • fieldbank_account
  • employee_idhashed
  • approvallinked · approver identity
Dropped before export
  • old and new value
  • employee name and address
  • free-text comments
  • attachments
The control plane sees that a protected field changed, who changed it and whether it was approved — not the value.
Illustrative · example event

Mandates that fit this work

Field-level rules for the most sensitive data you hold

HR agents should do the routine work and nothing more. Mandates set out, field by field, what they may change and what needs a person.

  • Versioned: edit a rule and every historical run is re-checked
  • Detection first: breaches become exceptions for a named owner
  • Enforcement later, only at the tool boundaries you choose
Mandate · Onboarding AgentL2 · act with approval
  • Writable HRIS fields
    job · org unit · start date · manager

    The agent may set core employment fields from the signed offer.

  • Protected fields
    bank_account · salary · tax ID

    No agent writes. A person sets these, with approval.

  • Access within role template
    groups ⊆ role template

    Any group outside the role's template is an exception for the access owner.

  • Human approval
    privileged access · contract terms

    Privileged access and changes to contract terms need a named approver.

  • Read scope
    assigned case only

    Helpdesk agents open records only for the employee they're helping, where reads are logged.

  • Acts under its own identity
    no delegated HR logins

    So the HRIS audit trail shows agent and person separately.

Example mandate · adapted to your policy during the pilot

Metrics on the scorecard

Faster onboarding, with every protected field accounted for

Cost and speed sit next to control metrics, so no one optimizes one at the expense of the other.

M01Cost per completed onboarding
Agent spend divided by new joiners who reached day-one ready with every step confirmed in its system.
M02Time-to-ready
Elapsed time from offer accepted to day-one ready, and where each run waited.
M03Unauthorised field changes
Agent writes to protected fields — bank details, salary, tax data — outside mandate or without approval.
M04Access exceptions
Group memberships granted outside the role template, with the run and approver behind each.
M05Takeover rate
Share of onboardings or helpdesk cases a person had to finish.
M06Evidence coverage
Share of steps the agent claimed that the HRIS, identity provider or service desk confirms.

Every metric is defined, versioned and traceable to its source records. Allocated platform fees are labeled as allocated.

Who it's for

For HR operations and the teams who safeguard employee data

Head of HR Operations

“Are onboarding agents getting people ready faster — and at what cost?”

Cost per completed onboarding and time-to-ready, by agent and team.
Data Protection Officer

“What personal data do HR agents touch, and is it minimized?”

Field-level mandates, a record of protected-field changes and documentation of what leaves the network.
CISO / access owner

“Are agents granting access beyond the role?”

Access exceptions with the run and approver behind each, before the start date.
Employee relations

“Can we explain to employees and their representatives what agents do?”

Written mandates and a factual record of agent actions — an account of agents, not a tool for monitoring staff.

How a pilot works here

Start with onboarding

One agent, the HRIS, the identity provider and the service desk. We baseline cost per completed onboarding and time-to-ready, and draft field-level mandates with your HR, access and data-protection owners.

See the pilotHow it works
Pilot scope · People operationsSix weeks · read-only
Workflow
Employee onboarding
Agent runtime
One agent runtime or HR vendor agent
Systems of record
HRIS · identity provider · IT service desk
Access
Read-only. No changes to your agents.
Success criteria
e.g. a target time-to-ready at equal cost, or a defined set of protected-field and access findings
  1. Week 0
    Connect
  2. Week 2
    Baseline
  3. Week 4
    Mandates
  4. Week 6
    Decide
Does employee personal data leave our network?
Personal values don't. The collector runs in your network, hashes identifiers such as employee IDs and drops field values — including bank details and salary — before export. The control plane sees that a protected field changed, who changed it and whether it was approved, not the value.
Is ThetaLayer an employee-monitoring tool?
No. ThetaLayer accounts for what AI agents do. It reads audit logs that also contain people's actions — an approver's decision, for example — so we document exactly what is collected and why, to support your data-protection and works-council processes.
Which HR systems can it read from?
ThetaLayer is built to read HRIS audit trails (for example Workday), identity provider logs, IT service management (for example ServiceNow) and approvals. Connector availability is confirmed during pilot scoping.
Can it stop an agent from changing bank details?
At the start it detects and flags; it doesn't block. Once mandates are agreed, enforcement can be added at a tool boundary you choose — for example, rejecting agent writes to bank-detail fields.

Book a Demo

See an onboarding run reconstructed, field by field.

Book a 30-minute walkthrough. We'll show how agent actions are recorded without personal values, and scope a six-week, read-only pilot on your onboarding workflow.

Book a DemoSee the pilot