Does Fabriq plug into our HRIS and identity setup?

Yes. It drops into the stack you already run, inheriting roles and relationships from your identity systems. The HRIS stays the system of record; Fabriq decides, per request, which records an agent can touch and which actions need an HR approver.

Can we control what each employee’s assistant can see and do?

Yes — per user. An employee’s assistant resolves against their own records; a manager’s assistant widens only to that manager’s team; sensitive categories like compensation and investigations stay separately gated regardless of who is asking.

What about recruiting data?

Recruiting agents are limited to the candidates and interviewers in their process. They can coordinate schedules and communications without the ability to reveal unrelated candidate records, and their access ends when the recruiting relationship does.

How is offboarding handled?

Revoke the person’s session and it dies immediately; their agents lose access with them, and the history of what those agents did stays reviewable.

Can HR-sensitive actions require sign-off?

Yes — reads can flow while changes to records or access are held for human approval, controlled per person and per action.

Who can see what an assistant did?

Every action is attributed — the employee who asked, the agent that acted, and the verdict — so questions about access to people data end in a query, not an interview.

Department · HR / People

Protect employee data while automating people operations

Let agents support employees without exposing sensitive workforce data or making unauthorized decisions.

Get a demo

The problem

HR agents frequently need access to highly sensitive records: compensation, health information, performance reviews, immigration data, investigations, and organizational changes.

A general-purpose employee assistant may appropriately answer a benefits question while having no reason to view another employee’s salary or performance history. Permissions must change based on who is asking, whom the data concerns, and the purpose of the request.

Agentic Fabriq enforces those distinctions.

Live workflow

See a real workflow, governed

Every agent below carries its own identity and acts for a real user. Watch every tool call route through Fabriq — then edit the workflow yourself.

An onboarding agent reads a new hire's start date and role from the HRIS, then provisions only the resources approved for that role.

agent: onboard-bot-01

Offer acceptedHRIS

Onboarding Agentonboard-bot-01 · for: hrops@acme.com

Agentic Fabriqidentity · policy · audit

HRISread start date + role

Slackwelcome + add to channels

Google Calendarschedule orientation

Drag nodes, draw connections, add tools — every agent action routes through Fabriq. Try wiring the agent straight to a tool.

The stakes

Why this is hard today

01An assistant that answers benefits questions connects to the same HRIS that holds salaries, health data, and investigations.
02Whether a question is okay depends on who’s asking and about whom — a static role can’t express that.
03A manager’s helpful assistant is one vague request away from another team’s performance reviews.
04When automation changes someone’s pay or status, there’s often no record of who actually authorized it.

Capabilities

How Fabriq helps HR teams

Limit agents to the requesting employee’s own records where appropriate.A benefits question resolves against the asker’s own eligibility data — the agent never needs, or gets, anyone else’s file.

Apply manager, HR business partner, recruiter, and executive access rules.The agent’s reach mirrors the human role it serves, so a manager’s assistant sees a manager’s slice and nothing more.

Separate access to compensation, performance, benefits, and investigation data.Each sensitive category is its own scope; access to one implies nothing about the others.

Require approval before an agent changes employment status, compensation, or access.People-impacting changes always pause for an HR approver, no matter how routine the request appears.

Restrict recruiting agents to approved candidate and interviewer information.Coordination runs on the data the process needs, without exposing unrelated candidates or internal records.

Remove agent access when an employee, contractor, or recruiter relationship ends.Access follows the relationship and ends automatically, instead of sitting on someone’s cleanup list.

Record how sensitive personnel actions were initiated and approved.Every status, pay, or access change carries who asked, which agent acted, and who approved.

In practice

Example workflows

logged

An employee assistant that can answer benefits questions using the employee’s own eligibility data.

Scoping to the requester’s own record makes “what’s my coverage” safe to automate at scale.

scope: scoped access

A recruiting agent that coordinates interviews but cannot reveal unrelated candidate records.

Scheduling data flows freely while other candidates’ records stay outside the agent’s scope.

approval: human approval

An onboarding agent that provisions approved resources based on role.

Provisioning follows the role’s approved resource list, with anything privileged escalating to IT or HR.

logged

A manager assistant that can draft performance feedback but cannot access another team’s reviews.

Drafting uses the manager’s own team data; another team’s reviews are simply unreachable.

Business value

Better employee service and HR productivity without turning a conversational interface into unrestricted access to workforce data.

Questions

Protect employee data while automating people operations

See a real workflow, governed

Why this is hard today

How Fabriq helps HR teams

Example workflows

Common questions