An AI agent for HR has to read the policy library your team wrote

Someone at your company asked last week how much unused PTO carries over. The answer sits on a policy page HR published months ago, and the question still waited two days in the inbox. The work is finding that page, quoting it correctly, and writing back. Kortix, the open-source AI Operating System, puts an agent on that job.

The HR agent we run reads the same policy library your team writes, drafts the reply in Gmail, and hands anything about a person to a human. What you get from an HR agent depends on where it is allowed to read, and on who set the limits.

The policy question is the volume, not the exception

An AI agent for HR reads a request and finds the policy or record behind it. Then it either drafts an answer or takes one defined action, inside a scope somebody set.

Two jobs hide under that name. The records job is a leave request, a pay change, a new hire's accounts. The correspondence job is the same handful of policy questions arriving every week, each with a written answer. Each one waits on a person to find and quote it.

The records job belongs in your HRIS, and the major HR suites sell an agent that does it well. The correspondence job fills the inbox. That is where the suites and your policy library part company.

The suites ground their agents inside their own product

Workday says it plainly. At Rising on 13 October 2026 the company announced that Sana is the new Workday Home. Sana Concierge can "find the relevant policy" and resolve a request by "applying the relevant policies and permissions". Workday calls the context behind that "a company's people, pay, policies, permissions, and business processes". It says the combination of that context and the guardrails built into its platform is what makes this possible (Workday, October 2026). Sana Concierge is in early access, with general availability expected in the first quarter of 2027.

Workday's autopilot agents follow the same pattern. They "inherit each company's policies, permissions, and approval rules from day one", and customers decide which tasks run on their own (Workday).

Oracle announced its Fusion Agentic Applications for HR in August 2026. They read "unified enterprise data, workflows, policies, approval hierarchies, permissions, and transactional context" from inside Fusion Cloud HCM (Oracle).

Lattice aims its agent at a narrower set of questions. It is "grounded in your company's people data across reviews, feedback, goals, engagement, growth, and 1:1s". Because that data is already in Lattice, teams "can start getting value as soon as it is enabled" (Lattice). A data question comes back as a chart or table, with a link to the full report.

If your policies already live in Workday, the concierge is the right place for an employee to ask. The requirement underneath each product is the same. The policy has to be inside the suite, and the question has to arrive through its front door. For a company whose policy library is a wiki HR edits on Tuesdays, that is a migration project with a vendor attached.

A 15-minute loop that reads where the answer already is

The HR agent we run on Kortix starts from the library instead. A cron trigger fires every 15 minutes and spawns a fresh session in its own sandbox, with read-only access to the HR Gmail inbox and the Notion policy library plus one channel into Slack. It reads new questions and classifies each one. For anything the library covers, it finds the exact policy section, then drafts a grounded reply as a Gmail draft.

Anything ambiguous, legal, personal, or compensation-related goes to the HR Slack channel with the question and why it needs a person. The agent does not attempt an answer. Each thread is labelled so the next run leaves it alone. A fresh session has no memory of the last one, so the label does that work.

The triage bar travels with the agent as a skill. It says what counts as answerable from policy, the exact escalation triggers, and how closely a draft must follow the source text. That bar is worth arguing about, so it lives in the repo you can read and change.

kortix_version: 2
default_agent: hr-policy

agents:
  hr-policy:
    file: agents/hr-policy.md
    connectors: [gmail, notion, slack]   # inbox, library, one escalation channel
    secrets: none
    skills: [hr-policy-triage]           # the escalation bar, as files you can read
    kortix_permissions: [project.file.read]   # no project.gitops.merge

triggers:
  - slug: hr-inbox
    type: cron
    agent: hr-policy
    cron: "0 */15 * * * *"               # second minute hour day month weekday
    session_mode: fresh
    prompt: |
      Read new HR inbox questions, draft replies from the Notion policy library,
      and escalate anything ambiguous, legal, personal or compensation-related to Slack.

Drafts only, and no exceptions

The agent has no send authority. Every answer is a Gmail draft that HR reads and sends. It cannot grant, waive, or bend a policy, and it never edits a Notion page. Those are design choices: a draft keeps the write with the person accountable for it, and a policy exception is a judgment call that belongs to HR.

The searching and the quoting shrink, and the exception work becomes a larger share of the role. That is the accommodation request, the compensation conversation, the question that turns out to be about a manager. The agent routes those on the next 15-minute pass and says why, and a person works them.

Onboarding stops at the approval gate

The second agent we run starts from a signed webhook from the HR system. A new-hire record fires it. Each firing gets one session, one hire, one disposable machine, seeded with role, team and start date. Through scoped connectors it prepares the Google Workspace account and the team's Slack channels. It files a first-week checklist in Linear.

Account creation and group membership stop at a human approval gate before anything is provisioned. The steps that grant access wait for a person to confirm them. Everything up to that point does not. No agent in this flow decides what a new hire is entitled to. None of them issues an account on its own say-so.

What you can put in front of a works council

An HR leader explaining this to a works council or an auditor needs controls that can be inspected. Five carry that weight:

• Everything is code. The agent's persona, its skills, and its per-system permissions are files in a git repo the company owns.
• A change is reviewed. Session work reaches main through a change request. Merge is default-deny for agents.
• You set the gates. Approval gates you set. Off until you set them.
• Connector credentials never enter the machine. They are brokered server-side.
• Every run is its own sandbox. One isolated sandbox per session.

For the longer version of how tool access is scoped, see how to give an agent tool access without handing over a key. For the failure modes these controls map to, see building reliable agent workflows.

Four questions to ask before you sign

Feature lists from three vendors read alike, so ask these four questions.

• Where does the policy text come from? Name the library, then ask who edits it and how long a change takes to reach the agent's next answer.
• What may it do without a person? Ask for the written list: draft, send, provision, grant. Anything unlisted is a claim, not a control.
• What does it record? Every action, the source it quoted, and who approved the write. If you cannot read that record, you cannot audit the answer.
• Where does it run? Whose cloud holds the policy library and the inbox, and can you move both to your own network.

No single product wins on all four for every company. A company whose policies live in Workday should buy Sana Concierge. Kortix fits when the policy your HR team wrote sits outside the HRIS and the questions arrive in a shared inbox. The escalation bar then belongs in a file you can read before it changes an answer.

Start with the policy library you already have, and see what the agent drafts in week one.

Try Kortix