Every article in this series so far has been about AI that drafts: a job description you review, a comp analysis you verify, a policy summary you fact-check. That’s generative AI’s whole job — produce something, hand it back, wait for a human to decide what happens next. The human is always the last step before anything real happens in the world.
Agentic AI breaks that pattern on purpose. Instead of producing a draft and stopping, an agent is given a goal, a set of tools, and the ability to take multiple steps toward that goal without checking in after each one — sourcing a candidate, updating their ATS record, sending the outreach email, parsing the reply, booking the interview slot, and remembering all of it for the next step, with no draft ever shown to a human in between. The shift isn’t “smarter AI.” It’s AI that closes the loop between deciding and doing.
That one change rewrites almost everything about how HR needs to think about risk, oversight, and what “human in the loop” actually has to mean.
- Generative AI in HR drafts — a job posting, a comp suggestion, a review summary — and a human decides what happens next. Agentic AI closes that loop: it plans multi-step workflows and takes real actions (emails, scheduling, HRIS updates) without a human reviewing each step.
- Three things define an agent vs. a drafting tool: it uses real tools/APIs, it plans multi-step sequences on its own, and it remembers context across steps.
- This is already showing up in real products — Claude Cowork’s HR plugin can draft an offer letter and route it for signature via connectors, which is the same architecture fully autonomous systems are built on.
- Onboarding is the furthest-along, least risky use case (low-stakes, reversible actions). Compensation and promotion is where the line should hold hardest — a wrong number that gets acted on is a different category of risk than a wrong number a human catches in a draft.
- Three new risks specific to “acting” rather than drafting: irreversibility (actions can’t be undone the way drafts can), blast radius (one bad call can trigger a chain of compounding actions), and human oversight quietly becoming decorative once reviewers stop really checking.
- The emerging governance model: sort every possible agent action into auto-execute (low-risk, reversible), escalate (human must approve), or block (never autonomous — hiring, termination, ratings, pay).
- Practical must-haves before giving any AI tool the ability to act: a full action log (not just decisions), a real undo path, a named accountable owner, and a gut-check test — could a real person explain why this happened, or did a “supervised” system just do it alone?
What “acting” technically involves
Three things distinguish an agent from a chatbot or a drafting assistant:
- Tool use. The agent doesn’t just generate text — it calls real systems: your ATS, HRIS, calendar, e-signature platform, Slack. A drafting assistant tells you what an offer letter should say. An agent can draft it, route it for the candidate’s signature, and update the requisition status, all without a human touching any of those steps individually.
- Multi-step planning. A single instruction (“fill this role”) becomes a sequence the agent works out on its own: search candidate pools, screen against criteria, rank, contact top candidates, schedule interviews, follow up on non-responses. Traditional automation runs a fixed script; an agent adjusts the sequence based on what happens at each step.
- Persistent memory across steps. The agent remembers what it already tried, what worked, and what a candidate said three steps ago, instead of treating every action as a fresh, context-free task.
This is already showing up in real HR tools, not just roadmaps. Claude Cowork’s HR plugin, for instance, can draft an offer letter and — with the right connectors set up — route it for signature directly, instead of stopping at the draft. The mechanics described in this series’ earlier piece on the HR plugin (connectors, sub-agents, explicit “don’t decide this without a human” instructions) are exactly the building blocks agentic systems are made of. The plugin isn’t fully autonomous today, but the architecture is the same one autonomous systems are built on — which is exactly why the boundaries you set in it matter more than they look like they do.
What changes across the HR lifecycle
Recruiting. Draft mode: AI helps you write a job posting and screen resumes you still personally review. Agentic mode: the system sources candidates across platforms, ranks them against a rubric, reaches out, schedules interviews, and follows up — and a recruiter might only see the process at the point a candidate is ready for a human interview. The work compresses dramatically. So does the number of decision points where a human was actually looking.
Onboarding. Draft mode: AI generates a 30/60/90-day plan you hand to a manager. Agentic mode: the agent provisions accounts, triggers benefits enrollment, schedules first-week meetings, and nudges the manager and new hire automatically as milestones approach — coordinating across IT, payroll, and facilities systems without anyone manually kicking off each step. This is, by most accounts, the use case where agentic HR tools are furthest along and least controversial, because the actions are low-stakes and reversible.
Compensation and promotion. Draft mode: AI suggests a pay band you take to a comp committee. Agentic mode: an agent could, in principle, flag pay equity gaps and trigger an adjustment workflow on its own. This is exactly where the line should hold hardest — the compensation-accuracy problems already documented with draft-only tools (systematic underestimation at senior levels) become a different category of risk entirely once a tool can act on a wrong number instead of just suggesting one for a human to catch.
Performance and attrition. Draft mode: AI summarizes 360 feedback for a manager to personalize. Agentic mode: an agent could monitor engagement signals, flag a “flight risk,” and automatically trigger a retention workflow — outreach, manager alerts, even a counteroffer recommendation — based on patterns in data the employee never knew was being watched that way.
Also read: Where AI in HR Creates Legal Exposure: A Practical Risk Audit
The risk surface that opens up
Everything in the earlier risk-audit piece in this series — screening bias, disclosure failures, vendor liability — still applies to agentic systems. But three new problems show up specifically because the AI is now acting, not just suggesting:
Irreversibility. A bad draft costs you the time to redo it. A bad action — an offer sent at the wrong comp number, a rejection email sent to the wrong candidate, a benefits enrollment triggered incorrectly — has already happened in the world by the time anyone notices. The cost of an error scales with how hard it is to undo.
Blast radius. A single bad instruction to a drafting tool produces one bad draft. A single bad instruction to an agent that takes 12 sequential actions can produce 12 compounding consequences before a human sees any of them — each step builds on the last, so an early mistake propagates rather than staying contained.
The “human in the loop” can quietly become decorative. The honest failure mode isn’t removing human oversight — it’s keeping a human nominally in the loop while that human stops meaningfully checking anything, because the agent is usually right and reviewing every action feels like friction. A sign-off step that’s never actually exercised provides no more real protection than no sign-off at all, and is harder to notice because it looks like governance from the outside.
The framework that’s emerging: auto-execute, escalate, block
The clearest governance pattern showing up across organizations piloting agentic HR tools sorts every action an agent might take into three tiers:
- Auto-execute — low-risk, reversible actions the agent handles entirely on its own: answering a policy question, sending a scheduling reminder, updating a non-sensitive record.
- Escalate — actions where the agent prepares a recommendation but a human must approve before it happens: flagging a flight risk, suggesting a shortlist, recommending a comp adjustment.
- Block — actions an agent should never take autonomously, full stop, regardless of confidence: final hiring decisions, terminations, performance ratings, anything that finalizes a person’s pay.
The categories matter less than the discipline of having drawn them explicitly, in writing, before the agent is given the tools to act — and revisiting them as the agent’s actual track record gives you more (or less) reason to trust it with a given category.
Also read: Claude for HR: The Honest, Detailed Guide
A practical checklist before giving any AI tool the ability to act
- List every action the tool could take, not just the ones it’s meant for. If it has a connector to your HRIS, it can probably do more than the one workflow you set it up for. Audit the actual permission scope, not your intended use case.
- Assign every action a tier — auto-execute, escalate, or block — before turning it on, not after watching it run for a while.
- Make escalation real, not decorative. Track whether the human reviewer is actually changing or rejecting recommendations sometimes. If the answer is “never,” find out whether that’s because the agent is excellent or because the reviewer has stopped looking.
- Build the undo path before you need it. For every auto-execute action, know exactly how you’d reverse it — and how long you’d realistically have before that’s no longer possible.
- Keep a full action log, not just a decision log. When something goes wrong, you need to reconstruct the entire chain of steps the agent took, not just the final outcome.
- Name a single accountable owner per agent, not “HR” as a department. Autonomous systems blur responsibility by design; someone specific needs the authority to pause one.
- Re-run your legal risk audit specifically for action, not just content. A screening tool that ranks candidates for a human to review and one that auto-rejects candidates below a threshold can trigger very different disclosure and audit obligations, even using identical underlying logic.
What should probably never leave draft mode
Regardless of how good the underlying model gets, a few categories of HR decision are worth holding at “draft only, human acts” indefinitely, not because the technology can’t do more, but because the cost of being wrong is borne by a specific person who didn’t get a say:
- Final hiring, promotion, and termination decisions
- Performance ratings that affect pay
- Any compensation number reaching a candidate or employee
- Anything that would be hard to explain, after the fact, as “a human decided this”
That last test is a useful gut check for any agentic HR workflow you’re evaluating: if a regulator, a court, or just the affected employee asked “who decided this, and why,” would there be a real person with a real answer — or just a system that was technically supervised by someone who’d stopped looking?
The bottom line
Generative AI in HR changed how fast you could produce a draft. Agentic AI changes who — or what — is taking the action that follows. That’s not a bigger version of the same risk; it’s a different risk entirely, because the moment of human judgment that used to sit between “AI suggests” and “something happens” can disappear if you don’t deliberately design it back in. The organizations that get this right won’t be the ones with the most autonomous agents — they’ll be the ones who can say exactly which actions their agents are allowed to take alone, and prove a human is still really watching the ones they aren’t.
