What can an AI agent do with
Payroll employees?
This lets the app view and change your employees in Xero Payroll. Depending on your country, that includes leave, salary and wages, pay templates, and the bank account their pay goes to.
How to spot it
On a Xero connection or settings screen, this is payroll.employees.
With it, an agent can
- Add employees and update their details.
- Update salary, wages, and pay templates.
- Manage leave and leave balances.
- Set the bank account an employee is paid into. In Australia this is part of the employee record. In the UK and New Zealand it is the employee's payment method.
It cannot, on its own
- Create or post pay runs. That is payroll.payruns.
What a bad day looks like
A tricked agent could change the bank account an employee is paid into, so their next pay could go to the wrong account.
Set it up safer
- Use payroll.employees.read if it only needs to look.
- Have a second person check any change to employee bank details.
Ask the company selling the agent
- Will your agent ever change employee bank details?
- Can I approve every payroll change before it saves?
Source
Checked against Xero documentation on 2026-09-28. All Xero permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.