Explaining payroll exceptions,
integrated in 4 hours.

The company.

Prisma Data Sdn Bhd is a Malaysian HR and payroll SaaS platform serving over 200 enterprise clients across manufacturing, retail, and professional services. Their platform processes more than 1.2 million employee records per month — handling everything from statutory contributions and leave management to salary dispute resolution and payroll exception flagging.

Prisma Data introduced AI-assisted payroll exception flagging in early 2025. The system automatically identifies anomalies — unusual overtime claims, duplicate salary entries, suspected benefit manipulation — and flags them for HR review. When a flag results in a payment hold, the affected employee is notified that their payroll has been suspended pending investigation.

By mid-2025, Prisma Data was processing approximately 3,400 exception flags per month across their client base. Their legal team flagged an emerging problem: with Malaysia's AI governance direction and the PDPA in mind, each payment hold was treated as a Significant Decision — and the team decided that every affected employee should receive a formal explanation.

3,400 decisions.
Zero explanations.

Before DecisionCore, Prisma Data had no mechanism to generate formal explanation records. When an employee disputed a payment hold, HR teams would manually reconstruct the reasoning from the exception log — a process that took 3–5 business days per dispute and relied on the availability of the analyst who originally reviewed the flag.

Three compounding problems made this unsustainable:

Governance exposure. Malaysia was moving towards AI governance legislation, with the National AI Office's AIGE principles already calling for transparency. Prisma Data's AI exception engine was a textbook Significant Decision system. Generating explanations retrospectively, on dispute, was not good enough — the explanation needed to exist at the point of the decision.

PDPA consent gaps. The PDPA Amendment Act 2024 requires granular, per-purpose consent for employee payroll data processing. Prisma Data's existing consent model was a single blanket clause buried in the employment contract. No per-purpose records. No withdrawal mechanism. No version tracking.

Breach notification risk. With 1.2 million employee records under active processing, a breach likely to cause significant harm would have to be notified to the PDP Commissioner within 72 hours. Prisma Data had no automated breach detection — their DPO was relying on ad hoc security alerts that averaged 96 hours from incident to awareness.

DecisionCore at the
point of every flag.

Prisma Data integrated DecisionCore into their exception flagging pipeline via the REST API. The integration was written in Python and added a single POST /explain call at the point each exception flag was raised and resulted in a payment hold action.

import requests
from app.config import settings

def flag_payroll_exception(employee_id: str, exception_type: str,
                           rule_description: str, amount: float) -> dict:
    """Raise a payroll exception flag and generate a formal explanation."""

    # Generate explanation at point of decision
    response = requests.post(
        f"{settings.DC_BASE_URL}/explain",
        json={
            "decision": f"Payroll exception flagged: {exception_type}",
            "subject_description": (
                f"Employee {employee_id}. Rule triggered: {rule_description}. "
                f"Amount under review: RM {amount:,.2f}."
            ),
            "sector":    "hr",
            "tenant_id": "prisma-data",
        },
        headers={
            "Authorization": f"Bearer {settings.DC_API_KEY}",
            "Content-Type":  "application/json",
        },
        timeout=60,
    )
    response.raise_for_status()
    result = response.json()

    # Store audit_id alongside the exception record
    return {
        "exception_id": create_exception_record(employee_id, exception_type, amount),
        "audit_id":    result["audit_id"],
        "report_url":  result["report_url"],
    }

Six months
after deployment.

In the scenario, after six months of operation, Prisma Data's DPO gives an assessment of the compliance posture across three dimensions: regulatory readiness, dispute resolution efficiency, and data incident response.

An unexpected benefit emerged from having structured explanation data at scale: Prisma Data's compliance team identified three systematic rule calibration issues in their exception engine. The DeepSeek R1 reasoning chains consistently cited edge-case conditions that the original rules had not accounted for. Two rules were recalibrated, reducing false-positive exception flags by 18%.

Architecture
overview.

Prisma Data's DecisionCore deployment runs entirely within their private cloud — a single VM on their colocation node in Kuala Lumpur.