A payroll agent reads the draft Gusto pay run, compares it to the prior period and the BambooHR roster, flags anomalies (rate changes, hours outliers, missing time-off accruals, new tax jurisdictions), and writes a structured review row into Dock. The named payroll lead approves or rejects each flag in Dock before the run is committed in Gusto. Gusto stays the payroll system of record. Dock is the named record of who looked, what they decided, and when.
The architecture
Gusto and BambooHR stay the system of record for the raw data: gross pay, deductions, tax filings, employee status, PTO balances. Dock is the system of record for what the agent interprets from that data. Each Dock review row carries a pointer back to the platform record (gusto_pay_run_id, bamboohr_employee_id), the agent's identity, the decision, the named reviewer, and the timestamp. The agent re-fetches Gusto draft state via fresh API reads when it returns to the row, so a stale Dock cache never overrides a current Gusto number. See agent identity for why the agent must sign with its own credential, not a borrowed admin login.
Dock surface: payroll-anomalies-2026-05-b
| flag_id | gusto_pay_run_id | bamboohr_employee_id | anomaly | agent | proposed_action | reviewer | decision | decided_at |
|---|---|---|---|---|---|---|---|---|
| FLG-0418 | pr_2026_05_b_77 | emp_0142 | Hours 142% of 4-week median (78h vs 55h) | payroll-agent-v3 | Hold for review | payroll-lead@acme | approve_payment | 2026-05-29 16:04 UTC |
| FLG-0419 | pr_2026_05_b_77 | emp_0271 | Pay rate +18% vs prior run; no comp-change record in BambooHR | payroll-agent-v3 | Block until comp letter linked | payroll-lead@acme | block | 2026-05-29 16:11 UTC |
| FLG-0420 | pr_2026_05_b_77 | emp_0309 | New CA tax jurisdiction; address change in BambooHR 2026-05-12 | payroll-agent-v3 | Confirm withholding setup | payroll-lead@acme | approve_with_note | 2026-05-29 16:18 UTC |
One worked workflow
The agent reads the draft pay run from Gusto and the active roster from BambooHR. It opens the payroll-anomalies table and writes one row per flag, each linked to gusto_pay_run_id and bamboohr_employee_id. The payroll lead opens Dock, sees three flags, clicks into FLG-0419, and reviews the BambooHR record. No comp letter is attached. She marks the flag block and assigns it back to the people ops partner. The agent will not advance the Gusto run while any row in this set is in block state. Once the comp letter is uploaded and the row flips to approve_payment, the agent calls Gusto's approve-and-submit endpoint, then writes the resulting pay_run_committed_at back onto the same Dock rows.
The consent gate is the row state. The named approver is a human. The agent does not self-approve its own flags.
Why it matters
Payroll errors are not retryable in the soft sense that an email draft is retryable. A wrong direct deposit goes out, and you spend two weeks on reversals, amended W-2s, and a tense conversation with finance. The IRS requires employers to deposit and report employment taxes accurately on a schedule, and corrections trigger Form 941-X and potential penalties (see IRS Publication 15). The audit trail you want, the one a regulator or a SOC 2 assessor will ask for, is not "the agent did it." It is "agent flagged, named payroll lead approved at this timestamp, here is the BambooHR record that supports the rate change."
PayrollOrg (formerly the American Payroll Association) publishes the practitioner guidance most US payroll teams rely on for compliance hygiene; their resources at payroll.org treat reviewer-of-record and segregation of duties as table stakes. Dock encodes that as a row. The row is the evidence. See agent audit and compliance for how the same pattern serves finance and audit teams, and Dock for accounting for the GL-side mirror of pay-run journal entries.
This is the people ops shape, and the HR shape: agents propose, named humans dispose, every action is attributable.
Try it
Spin up a payroll-anomalies table in Dock, point your payroll agent at Gusto and BambooHR with its own identity, and run your next pay period through the row-as-consent-gate flow.
FAQ
Does Dock replace Gusto for payroll? No. Gusto remains the payroll system of record. Dock holds the agent's anomaly review and the named approval that gates the Gusto pay-run submission.
What does the agent actually write to Gusto? Only the approve-and-submit call, and only after every Dock row for that pay run is in an approved state. The agent does not edit individual paychecks.
How do we prove a human approved each flag?
Each Dock row carries reviewer, decision, and decided_at. The pointer back to gusto_pay_run_id ties the approval to the exact Gusto record, satisfying segregation-of-duties review.
What if the agent and the payroll lead disagree? The reviewer's decision is final. The agent records the disagreement on the row, fetches fresh Gusto and BambooHR state on the next run, and re-flags only if the underlying data still warrants it.
