# Keep payroll and compensation data out of an agent's reach

An HR connector exposes salaries, bank details, and terminations. Fence the sensitive reads to HR, freeze the writes, and mask financial identifiers.

For: HR and people-ops teams piloting an agent against payroll systems

Payroll is the textbook case for identity-gated access. The connector exposes compensation, pay registers, bank and routing numbers, and employment actions like terminations — data that most of the company should never see through an agent, and that a broad "summarize our team" prompt would happily surface.

The controls narrow the agent channel to need-to-know. `fence-comp-payroll-reads` denies the highest-sensitivity reads — salary, pay register, contractor payments, terminations — unless the caller is in the HR-payroll group, and fails closed when the claim is missing. `freeze-payroll-writes` blocks mutations so an agent can't run or alter payroll. `redact-financial-ids-egress` masks SSNs and bank details in any response, and `cap-roster-export` throttles full-roster pulls.

These group names are placeholders — map `hr-payroll-admins` to your own IdP group at import, and the fence enforces your real org boundary on the agent's path.

## Policies in this guide

- [Fence Gusto Compensation & Payroll Reads](https://www.intentbasedpolicy.com/policies/gusto/fence-comp-payroll-reads) — Denies the highest-sensitivity Gusto read tools unless the caller's IdP-asserted groups include the placeholder group hr-payroll-admins.
- [Freeze Payroll Writes in Gusto](https://www.intentbasedpolicy.com/policies/gusto/freeze-payroll-writes) — Freezes every write and delete operation on a Gusto pipeline.
- [Gusto: Redact Financial IDs in Responses](https://www.intentbasedpolicy.com/policies/gusto/redact-financial-ids-egress) — Instantiates PF-02 (redact-pii-egress) on the Gusto read path.
- [Gusto Cap Roster Export](https://www.intentbasedpolicy.com/policies/gusto/cap-roster-export) — Throttles full-roster exfiltration on Gusto's two broad outbound list tools — list company employees and list company contractors — by rewriting their…