Payroll

Approvals, RBAC & the Auto-Payroll Agent

Fintra payroll governance: the five RBAC roles, segregation of duties, the auto-payroll agent that drafts runs, and the anomaly gate that keeps it honest.

Updated July 7, 202610 min read1 labOwner / FounderAccountant

Automation in payroll is only trustworthy when the boring controls are unskippable. Fintra layers three of them: role-based access (who can touch what), segregation of duties (the submitter cannot approve), and - on top, not instead - an auto-payroll agent that drafts and checks runs but is structurally incapable of moving money.

The five roles and segregation of duties

Action	Admin	Clerk	Approver	Viewer	Portal
Settings, rates refresh, GL map	Yes	No	No	No	No
Employees, bank, deductions, garnishments	Yes	Yes	No	No	No
Create/edit/submit draft runs	Yes	Yes	No	No	No
Review / approve / reject runs	Yes	No	Yes	No	No
Process / mark deposited / void / edit	Yes	No	No	No	No
Reports & reads	Yes	Yes	Yes	Yes	No
Own paystubs / YTD / W-4 / bank	Own	-	-	-	Yes

Payroll RBAC matrix

Segregation of duties is enforced in the workflow: whoever submitted a run cannot approve it. An org-level opt-out exists for genuine solo operators, but it is off by default and should stay off wherever two humans exist.
Rejection sends the run back to draft with the reviewer’s notes - the clerk fixes and resubmits; nothing is edited "in approval".
Every state transition records who and when. The run history is the payroll audit trail an accountant or auditor reads first.

The auto-payroll agent

On schedule (or on demand), the agent prepares the next period’s run: it drafts, calculates every paycheck, computes anomaly flags, writes a plain-English summary of the run, and submits it into the normal approval workflow. From the approver’s seat, an agent-prepared run looks like a clerk-prepared run with an unusually thorough cover note.

What the agent does - and where it stops

1
Drafts and calculates
Builds the period’s run from employee records and schedules, exactly as a clerk would.
2
Screens for anomalies
Runs deterministic rules (below) and attaches flags plus a human-readable summary: what changed vs. last run, who is new, what looks off.
3
Submits - and sometimes auto-approves
The run enters approval. Auto-approval happens only when the org has opted in AND the run has zero flags AND every employee’s net pay is within $1 of their recent norm. The actor is recorded as the agent, distinctly from any human.
4
Stops
The agent never processes or deposits, cannot bypass the SSN gate or engine invariants, and its every action lands in governance records. Money movement is human-only.

Flag	Why it exists
Net pay >20% off the employee’s trailing-3-run median	Fat-finger hours, missed deduction, or a real change worth eyes
Bank details changed ≤7 days before payday	The classic account-takeover fraud window
First check for an employee	New records deserve one human look
Duplicate bank account across employees	Ghost-employee and redirection schemes
Duplicate SSN	Data error or identity problem - always investigate
Employee added and paid in the same period	The shortest ghost-employee pattern
Run cost >15% vs. previous run	Company-level sanity check

The anomaly rules (deterministic, not vibes)

A sane operating model with the agent on

1Let the agent draft every cycle - the clerk’s job shifts to maintaining employee data and handling exceptions.
2Keep auto-approval off for the first few cycles; read the agent’s summaries and flags until you trust the shape of "clean".
3Turn on auto-approval for clean runs when the summaries have been boring for a month or two - flagged runs still always wait for a human.
4Processing and deposit remain a named human’s deliberate act on payday, every time.
5Review the agent’s governance log monthly alongside the run history - five minutes that keeps the automation audit-ready.

Hands-on labs

Practice against a realistic scenario. Each lab lists the steps, what you should see, and the checkpoints that confirm you got the same result.

Lab 1

Supervise the agent through a flagged run

Scenario

Acme enables the auto-payroll agent. This period holds two real events: new hire Ben Carter gets his first check, and Sam Reyes changed his bank account four days before payday (he genuinely switched banks). Auto-approval for clean runs is ON - watch what the gate does.

Steps

1
Trigger the agent to prepare the period’s run.
Expected: A submitted run appears with a plain-English summary and two flags: first check (Ben), bank change ≤7 days before payday (Sam).
2
Confirm the run was NOT auto-approved.
Expected: Flags present → auto-approval is off the table; the run waits in approval.
3
Resolve Ben’s flag: open his paycheck, verify salary, W-4, and deductions against his offer letter.
Expected: Numbers match the $52,000 offer; note the verification in the review.
4
Resolve Sam’s flag the right way: call Sam on a known number and confirm he changed banks.
Expected: Sam confirms; the flag’s answer is documented, not dismissed.
5
Approve the run as Priya, then check the actor history.
Expected: History shows: prepared/submitted by the agent, approved by Priya - two distinct actors.
6
Process and deposit as the human admin.
Expected: Money moves only on this step - the agent never got the chance.

Checkpoints - you got it right if…

The anomaly gate blocked auto-approval on a run with flags
Both flags were resolved by verification (offer letter, phone call), not by dismissal
Run history shows the agent and the human as separate actors
Processing/deposit was performed by a human admin

Frequently asked questions

Can the auto-payroll agent ever move money?

No. The agent drafts, calculates, flags, summarizes, and submits; it can auto-approve only provably clean runs when the org opts in. Processing and depositing - the money-moving steps - always require a human admin, and the agent cannot bypass the SSN gate or engine invariants.

What counts as a "clean" run for auto-approval?

Three conditions, all required: the org has enabled auto-approve for clean runs, the anomaly rules produced zero flags, and every employee’s net pay is within $1 of their recent norm. Any flag, any drift beyond $1, or the setting being off means a human approves.

How do we audit what the agent did?

Every agent action is recorded - runs it prepared, flags it raised, anything it auto-approved is attributed to the agent as the actor, distinct from humans. Governance rows persist per run, and the run history plus the agent log give an auditor the full picture.

The approver is on vacation - can the clerk approve just this once?

Not while segregation of duties is on (the default): the submitter cannot approve their own run. The right fix is a second approver (the admin role can approve) - not weakening the control. Plan approver coverage like you plan payday.

Do the anomaly rules use AI or machine learning?

No - deliberately. The seven rules are deterministic (thresholds, day windows, duplicates) so the same run always produces the same flags and every flag is explainable in one sentence. The AI-flavored part is the plain-English run summary; the gate itself is arithmetic.

Previous in PayrollPayroll Taxes & Remittances, Explained

Keep going

PayrollPayroll Setup & Your First Pay RunRead doc PayrollPayroll Taxes & Remittances, ExplainedRead doc Compliance & TrustAI Governance with AgentFenceRead doc

Go deeper in the guides

AI in AccountingAI Accounting: The Practical Guide for Finance TeamsRead guide AI Finance OSWhat Is an AI Finance Operating System?Read guide

Ready to try it in your own workspace?

Fintra is the AI Finance Operating System for SMBs - accounting, payroll, planning, HR, and compliance under one login, with governed AI doing the heavy lifting.

Talk to us