Solutions

Resources

Law, Policy, Culture, Purpose: How to Build HR Agents That Get It Right

Joint article: Kerri O'Neill & Dr. Venkata Pingali
Focus: US and UK

About the authors

Kerri O’Neill

Kerri O'Neill is a chief people officer, transformation specialist, board director and author, working at the intersection of people and AI. Kerri is Chief People Officer for Ipsos in the UK and Ireland and its AI Workforce Transformation Lead. She is former Chief People and Transformation Officer for Ofcom and held senior HR positions at House of Fraser and Aviva. Kerri sits on the CIPD AI Advisory Board and is author of Rapid Reculturing: Transforming Organizations at Pace and Scale (Wiley 2026).

Website: https://rapidreculturing.com | LinkedIn: https://www.linkedin.com/in/kerriannoneill/

‍

Dr. Venkata Pingali

Founder and CEO of Carver Agents, building legal and regulatory infrastructure for AI agents. His work focuses on making legal requirements actionable within agent systems.

Website: https://carveragents.ai | LinkedIn: https://linkedin.com/in/pingali

‍

‍Core idea

HR agents are making their way into organizational life at an unprecedented rate. Law and policy tell an HR agent what it must and may do. Culture and purpose help it understand how and why. But getting all four right is not a one-time design exercise. Organizations need to make these layers explicit enough for agents to act on, resolve the tensions between them, and continuously observe, govern and teach their agents as they work. The result is not a fixed HR agent, but a learning system that becomes increasingly aligned with the organization it serves.

Loading…

1. Opening: compliant is not the same as right

An employee whose mother is terminally ill asks to reduce his hours for six months so he can care for her. An HR agent handles the first response.
A compliant reply is easy. The right one is much harder. It depends not only on what the law requires, but on what the organization has chosen to offer, how it treats people at moments like this, and what it exists to do.
HR agents are already screening candidates, answering policy questions, processing leave and drafting letters. They are moving from answering to acting: communicating with employees, changing records, initiating workflows and increasingly making or recommending consequential decisions.
Most are still built with “compliance” treated as a single block of rules. An agent that checks only the law will default to the legal floor. To act well, it has to operate across four distinct layers: law, policy, culture and purpose.
Humans navigate these layers through written rules, accumulated experience, cultural norms and judgement. Much of this knowledge is implicit: people learn not only what the rules say, but how they are interpreted and applied in their organization.
For an agent to act, that institutional knowledge has to be made explicit enough for a machine to use. But codification cannot mean rigidity. The system must tolerate ambiguity, support judgement and know when to involve a person rather than act alone.

2. Four layers: HR for a workforce of people and agents

The workforce is changing: people increasingly work alongside AI agents that perform tasks, take actions and represent the company. HR itself will change too, with HR professionals and HR agents together onboarding, supporting, evaluating and offboarding a workforce of both.
The four layers apply across this system, but differently:
- Law: employment law protects people; for agents, the law primarily governs the organization deploying them, including liability, data protection and discrimination arising from their actions.
- Policy: employment policies and codes of conduct govern people; permissions, access, acceptable-use rules and operating boundaries govern agents.
- Culture: shapes how people and agents behave, interact and represent the organization.
- Purpose: gives a common reference point for judging whether the work of both people and agents advances what the organization exists to do.
Organizations do not expect new employees to arrive knowing how everything works. They onboard them, give context and feedback, and gradually entrust them with more responsibility. Agents should be understood the same way: as learning systems rather than fixed software.
This raises a question HR cannot leave to others: who teaches the HR agents? Who decides what they learn, which behaviors are reinforced or corrected, and when they are ready for greater autonomy? We return to this at the end.

3. Law: the non-negotiable floor

Law is the non-negotiable floor. It cannot be configured away. An HR agent should never knowingly create a situation in which the law is broken.
Even for a single HR task, the legal landscape can be extensive. In the UK, it may include the Equality Act 2010, Employment Rights Act 1996 (as amended, including by the Employment Rights Act 2025), UK GDPR, Working Time Regulations 1998 and Health and Safety at Work etc. Act 1974. In the US, requirements may arise under Title VII of the Civil Rights Act, the Americans with Disabilities Act (ADA), Fair Labor Standards Act (FLSA) and Family and Medical Leave Act (FMLA), alongside state and local regimes such as California’s Fair Employment and Housing Act (FEHA) and New York City’s Local Law 144 on automated employment decision tools.
Statutes are only one part of it. Requirements and interpretations also arise from regulations, regulatory guidance, enforcement actions and judicial decisions. At Carver, our work mapping regulatory requirements has surfaced 16 distinct classes of legal instruments. Across jurisdictions and HR activities, the risk surface multiplies: jurisdictions × legal instruments × HR activities.
Finding these materials is not the same as understanding them. Legal meaning depends on definitions, exceptions, cross-references, precedent and the facts to which it is applied. Turning it into a reliable context for an agent means careful sourcing, identifying the precise legal units that apply, interpreting them, resolving dependencies, assessing criticality and risk, and matching the result to the situation at hand. None of these steps can be skipped if an agent is to take consequential actions rather than merely retrieve documents.
Nor should this process manufacture precision where the law provides none. Concepts such as reasonableness, proportionality and appropriate accommodation require judgement, and uncertainty can remain.
The task is not to give an agent access to the law, but to tell it what matters for this person, this action, this jurisdiction and this point in time, while preserving ambiguity, provenance and dependencies. Where requirements conflict, interpretation is uncertain or the stakes are high, the agent should recognise the limits of its authority and involve a person.

4. Policy: what the organization chooses

If law sets the floor, policy describes what the organization chooses to do within and above it. Policies turn legal duties into processes, explaining how the organization will act consistently and what it expects in return.
Policies must never undercut the law. Organizations also make choices above the legal minimum, such as enhanced leave, hybrid working, or a disciplinary process that starts with a conversation.
These choices matter. In the UK, tribunals look closely at whether an employer followed its own policies. Failing to do so can weaken its defence and increase compensation, particularly where a policy forms part of the employment contract, as enhanced sick pay often does. An agent that checks only the law can therefore create legal risk by skipping the organization’s own process.
Policy is also precise in ways the law is not. Many policies apply only to certain groups or once conditions are met, such as location, employment status, length of service or job level, and they change over time. The agent needs to know which policy, which version and which provisions apply to this person, in this situation, today.
Yet no policy covers every situation. The agent needs to understand what a policy is trying to achieve, not just what it says, so that it can apply that intent with judgement or recognise when a case needs a person.
Policy can also set consistent global standards across divisions and offices, for example on fairness, accountability, financial transparency and communication, while allowing implementation to reflect local law and circumstances.

5. Culture: how things really work here

Culture is how things really work in an organization: its norms, language, tone and unwritten expectations. It shapes what people believe and how they behave, and it accounts for much of what employees and customers actually experience.
An agent can apply the law and policy flawlessly and still get it wrong. A formal warning where the culture expects a conversation first is compliant, but it will feel alien to the people receiving it, and each misstep like this builds mistrust of the agent and resistance to using it.
The bigger risk is homogeneity. Out of the box, agents default to an average. If every letter, message and decision an agent produces sounds the same as every other employer’s, the organization loses what makes it real to its people. Over time, that hollows out the emotional connection people have with the place they work.
Culture is a particular challenge for agents because it is largely tacit. People learn it through observation, examples, feedback and experience, so some of it has to be surfaced before an agent can learn it.
But not all culture should be passed on. An agent trained on how things really work in an organization with a culture of gender bias will reproduce that bias at scale. AI amplifies culture; it does not correct it. The task is to give agents the culture the organization intends, not simply the one it has.
Unlike law or policy, culture is rarely best expressed as rules. It is taught through principles, examples and counterexamples, feedback on behavior, and explicit boundaries.
Good places to start are examples of good and bad letters and documents, and the organization’s shared beliefs and behaviors, as Amazon has done with its 16 Leadership Principles. Even there, the written principles and employees’ actual experience do not always match, which is why examples matter as much as statements.
Most powerful of all is to state clearly what the organization would never do, beyond what the law already forbids.
Culture also changes. Agents that are in regular dialogue with the people who shape the culture will stay aligned with it. And watching an agent work can expose ambiguity, inconsistency or undesirable norms that the organization itself needs to address.

6. Purpose: why the organization exists

Purpose is why the organization exists and the values it lives by: the North Star that connects everyone and everything it does.
To guide an agent, purpose has to be instructive and look forward. An origin story explains where the organization came from; a purpose that looks ahead tells people, and agents, what to do when no policy covers the situation. That is what experienced HR professionals draw on every day when a case does not fit the rules.
Purpose also sharpens risk judgement. An agent that understands purpose can tell the difference between a request that bends a rule and one that breaks its intent. It can see when applying the letter of a policy would defeat what the policy is for, and bring in a person rather than pressing ahead.
For this to work, purpose has to be more than a statement on a website. It is taught through strategic choices, principles, examples of difficult decisions and feedback on how the organization would approach them.

Purpose should not become another rigid rule, and it cannot override law. It operates within the boundaries set by the other layers. Law, policy and culture look back to what has been decided before. Purpose points forward, and gives the agent a way to act well when rules are incomplete, several courses of action are possible, or the organization meets something it has not seen before.

‍

7. Scenario: one request, four layers

Return to the employee from the opening. His mother is terminally ill, and he has asked to work reduced hours for six months so he can care for her and support his father.
Law. In the UK, he has a legal right to request flexible working from his first day. His employer must consult him before refusing, decide within two months, and can only refuse for specified business reasons. He may also be entitled to statutory carer’s leave, but that is one week of unpaid leave a year. In the US, there is no equivalent federal right to request flexible working, but if eligible, the FMLA may provide job-protected, reduced-schedule leave to care for his mother, for up to 12 weeks a year, well short of the six months he is asking for. His mother’s diagnosis is also sensitive health information about a third party, which the agent must handle with care under UK GDPR and US privacy rules.
Policy. His employer may offer far more than the law requires, such as paid carer’s or compassionate leave, or a temporary arrangement with a review date. He may not know these options exist. The agent needs to identify the policies and provisions that apply to his role, location and circumstances.
Culture. In this organization, the expectation may be that his manager calls him before any form is sent. The first response should sound like the organization at its best, not a case management system. The right action may be to hand the conversation to a person rather than trying to conclude it.
Purpose. If the organization says it exists to help its people do their best work over a career, a temporary arrangement may be an investment rather than a concession. The agent can bring that context into the decision rather than simply recommending, approving or rejecting.
A law-only agent might produce a perfectly compliant acknowledgement. A four-layer agent has a harder task: it must bring together requirements with different authority, specificity and ambiguity, resolve the tensions between them, exercise judgement and recognise when a person should step in. For an experienced HR professional, much of this happens through accumulated knowledge. For an agent, we have to design the system that makes it possible.

8. The person on the other side

Everything so far describes how to build the agent. But the employee in our scenario will not experience a layered architecture. He will experience a reply, at one of the hardest moments of his life.
Whether he trusts it depends on things no legal mapping captures: does he know he is dealing with an agent, does it sound like his employer at its best, and can he reach a person easily when he needs one?
Transparency should be a design principle, not a disclaimer. People should know when an agent is acting on the organization’s behalf, what it can and cannot decide, and how to challenge it.
Where employees have a collective voice, through unions, works councils or employee forums, they should help shape how HR agents are introduced.
Trust in HR has always been built one interaction at a time. Agents do not change that; they multiply the number of interactions in which it can be won or lost.

9. System and governance: building around the agent

The four layers cannot simply be placed into a prompt or knowledge base. They have different authority, owners and rates of change, and need to be represented differently. Law can be expressed as checkable obligations tied to jurisdiction and date. Policy needs to be versioned and validated against law. Culture and purpose provide context for behavior, judgement and escalation.

‍

Building an effective HR agent therefore requires a system around the agent: one that specifies the layers, determines what applies, resolves tensions between them, and keeps the agent within defined authority.
As ambiguity or consequence increases, the agent’s autonomy should decrease and human involvement should increase. Where the law or the organization requires judgement, the system should preserve that uncertainty rather than manufacture a precise rule. Governance surrounds the process rather than sitting at the end of it. Before an action, it can constrain it, require approval or prevent it. Afterwards, it observes what happened, evaluates the outcome, explains the reasoning and provides an audit trail.
When something goes wrong, the question is not simply how to correct the answer, but why the system produced it. The problem may lie in the sources, how they were specified, how tensions were resolved or how the agent was configured.
There are real limits. Mapping errors will happen. Institutional knowledge will only ever be partly made explicit: policies have gaps, culture is partly tacit, and purpose can be read differently by different people. More context is not always better context, and an attempt to encode everything can produce a system nobody can understand or maintain. Laws, policies and culture keep changing, and some judgement will remain irreducible.
These limits are not an argument against HR agents. They are the reason the system has to learn. Every action and outcome is information that can improve the sources, the specifications, the agent and sometimes the organization’s own policies and understanding of its culture and purpose. The goal is not the perfect HR agent on day one, but a governed learning system that knows its limits and becomes increasingly aligned with the organization it serves.

‍

10. What HR should do now

‍First, take ownership

HR agents act on employees on the organization’s behalf. That makes them HR’s business. Legal brings the law, technology builds the system and risk sets the controls, and HR cannot do this alone. But often only HR can bring together what the organisation intends: the policy intent, the culture it wants and the purpose that guides judgement. If HR does not define that, it will be left to default settings, and the default is the legal floor.
Ownership does not mean HR handling every interaction. As teams get smaller and decisions move faster, many employees simply want quick, clear answers without slow processes or hand-offs. Ownership means HR decides what good looks like, where an agent’s authority ends, and how difficult or consequential cases reach the right person. The Chief People Officer should be accountable for how HR agents behave, not just for whether HR uses them.

Then, make the right first moves

Start with one journey. Choose one common, meaningful request, such as flexible working or compassionate leave. Walk it through the four layers before you automate anything. You will learn more from one journey done properly than from a broad rollout.
Write your “never” list. What would your organisation never do to an employee, beyond what the law forbids? This is the most powerful cultural instruction an agent can receive.
Collect good and bad examples. Gather real letters, messages and decisions that show your organisation at its best and at its worst. Examples teach what principles cannot.
Draw the line on authority. Decide what an agent can do alone, what it can only recommend and what it must hand to a person. Start tight, and widen those boundaries as trust is earned. Responsibility for consequential decisions stays with people.
Watch, learn and fix the source. Regularly review a sample of real interactions with managers and employees. Ask whether the agent was right, how it made people feel, where it was handed over and what it revealed about gaps in your policies or culture. When something goes wrong, fix the cause, not just the answer.
The question for HR is no longer where AI can automate work. It is whether we are prepared to make explicit what we have always left implicit, and to take ownership of how our agents act on our behalf.

‍

We would welcome examples from organisations already confronting these questions: what have you made explicit, what remains difficult to codify, and where are you finding that human judgement still matters most?

Take the framework to your team

A 15-slide visual summary of the four layers (law, policy, culture and purpose), the carer's-leave scenario, and how HR can start teaching its agents. Useful for conversations with Legal, Technology and Risk.

‍Download the slides (PDF)

‍

United States
447 Broadway,
2nd Floor Suite #563,
New York 10013

Listen to Carver Conversations on Moltbook

AI Regulatory OS
Regulatory Intelligence
Regulatory Sources
Regulatory Platforms
Horizon Scanning
Regulatory Monitoring
Intelligence vs Compliance

Podcasts
Knowledge Base
Resources
Glossary
Use cases
Developers
Blog

Home
Legal Infrastructure
Regulatory Risk Intelligence
Technology
About Us

hello@carveragents.ai
General enquiries
support@carveragents.ai
Product support
legal@carveragents.ai
Privacy and legal requests
github.com/carveragents