devopsly.Let’s talk
HomeWorkHR assistant
← Selected work

AI product / HR and payroll

An assistant that
knows who is asking.

An AI assistant for HR and pay questions, built into an HR and payroll product. Each answer is checked against what that person is allowed to see.

Everyone asks“Why is pay different this month?”

Employee

Your pension contribution changed this month, so your take-home pay is lower. Your salary is unchanged.

Sees: their own pay record
Line manager

Two people in your team worked overtime this month. You can see their hours, not their deductions.

Sees: their team’s hours
Payroll manager

Payroll cost rose with overtime and new starters. The change matches the approved plan.

Sees: company payroll
Illustration · One question, three answers, each limited to what that role may see. Invented examples.

At a glance

Client
A UK HR and payroll software provider. Not named.
Constraint
Special-category personal data, releases that took weeks, and AI behaviour to manage across hundreds of customer environments.
Contribution
The assistant, the permission check behind every answer, a way to change its behaviour without a release, and the route that takes each change to production.
Result
Changes to the assistant arrive in minutes instead of weeks. Product releases moved from weeks to daily.

01 / The brief

Personal questions.
Precise answers.

HR and payroll questions are repetitive, personal and consequential. The answer to a question about someone’s pay depends on that person’s records, and only the right people may see them.

The assistant had to answer inside those limits, for employees, managers and HR teams alike.

It also had to keep improving. Its prompts, model settings and knowledge change far more often than application code, across hundreds of customer environments, while product releases still took weeks.

02 / What we built

The assistant,
and the way it ships.

Three connected pieces of work: how the assistant answers, how its behaviour is changed safely, and how the product reaches its users.

Assistant

Answers within permissions.

Multi-agent orchestration over GPT models on Azure AI Foundry, a retrieval knowledge base and permission-aware connectors. A safety layer screens requests for attempts to get around the rules.

Updates

Change behaviour without a release.

A configuration-delivery system carries prompts, model settings and knowledge updates to customer environments, separately from application releases.

Releases

One path to production.

Legacy workloads moved to Kubernetes on Azure, with GitOps as the single release path and a disposable preview environment for every pull request.

Delivery included Terraform, Helm, ArgoCD, GitHub Actions and Azure DevOps pipelines.

The product

Where people
already work.

The assistant is available inside the HR product and in the workplace tools staff already use. Whichever way a question arrives, it follows the same four stages.

Question → answerChecked per request
AskAn HR or pay questionFrom an employee, a manager or an HR team
Check + screenPermissions and safetyThe person’s access, then screening for misuse
Plan + retrieveAgents with grounded contextA knowledge base and permission-aware connectors
RespondAn answer for that personDrawn only on information they may see
System illustration · The main stages of a request, shown conceptually.

The release path

Every change
takes the same route.

A change is proposed, built into its own preview environment, reviewed and rolled out from version control. Development teams deploy for themselves through that path.

From a change to every environment
ChangeA pull requestApplication code, infrastructure or configuration
PreviewA disposable environmentA full environment for each pull request
ReleaseGitOps with ArgoCDDeclarative rollouts from version control
RuntimeKubernetes on AzureAKS, defined with Terraform and Helm
System illustration · The release path, shown conceptually.

Security and data

Built for sensitive
personal data.

HR data includes special-category personal data under UK GDPR and the Data Protection Act 2018. That shaped the engineering.

  • Platform controls aligned with ISO 27001.
  • Threat modelling using STRIDE.
  • The OWASP Top 10 for LLM Applications as a review baseline.
  • Security scanning in continuous integration, and a default-deny network posture.

These describe the engineering approach. They are not a statement of certification by Devopsly.

03 / The result

AI changes in minutes.
Daily releases.

Changes to the assistant reach hundreds of customer environments in minutes instead of weeks, and product release cycles moved from weeks to daily.

Every request is checked against the user’s existing permissions, and interactions are logged so they can be audited.

Results are Devopsly’s own account of the work. The client is not named.

A similar challenge?

Start with who may
see the answer.

A useful first conversation covers the questions your people ask repeatedly, where the answers live and who is allowed to see them.

Discuss your AI product

More selected work

Different problems. The same care.