Can AI answer payroll and HR questions safely?
Yes, when the AI is not allowed to decide. Canon answers BIP employees' payroll, vacation and benefit questions only from an approved source it can cite, and sends anything it cannot ground to a person. Fixed rules decide what to retrieve and cite, and the AI only rewords the reply or reads a field.
Why payroll needs a stricter design
A wrong payroll answer carries a legal cost under Brazilian labor law. According to Art. 20 of the LGPD, Brazil's 2018 data protection law, a data subject has the right to ask for a review of decisions made solely by automated processing of personal data that affect their interests. Canon answers only from an approved source it can cite and sends anything else to a person. Counsel decides what Art. 20 requires of a given use. The mapped load at BIP was about 1,415 hours a month, with no source behind any answer, and the same question returned the next day.
Canon, BIP
Canon answers BIP employees' payroll, vacation and benefit questions only from an approved source it can cite, and sends anything it cannot ground to a person. The decisions run on fixed rules, not on the AI: what to retrieve, what to cite, what counts as an answer. The AI only rewords the reply or reads a field, and the moment it is unsure the question goes to a person. A wrong payroll answer carries a legal cost under Brazilian labor law. The hub answers only when it can cite an approved source. Portuguese labor language is read the way a labor specialist reads it, not by a generic search. Personal data lives in a separate vault and is fully erased on request within 30 days, while the audit history stays whole.
Questions
Can the agent change HR records?
No. It reads the employee's data and can never write back, blocked in two places so it cannot happen by accident.
What about private matters?
A sensitivity check runs before the question reaches any AI and cannot be turned off, so a private matter never touches a model.
Can personal data be erased?
Yes. Personal data lives in a separate vault and is fully erased on request within 30 days, while the audit history stays whole.