Published on ZapierAug 4, 2026
Google Sheets
Create Decionis decision dossiers for new Google Sheets rows
Turn spreadsheet rows into governed actions—not blind automation.
For Approvals, finance operations, and spreadsheet-driven imports.
Loading…
Execution pattern
Payroll and HR process release
Check the run before it commits, not in the reconciliation.
- Category
- MoneyCommon in Manufacturing · Hospitality & travel · Healthcare · Public sector
- Works through
- workday
- Proof
- Signed Decision DossierVerifiable against our published JWKS.
- Deploy
- Shadow Mode firstMeasure on your own traffic before anything is stopped.
What executes
A payroll run commits, or an HR business process (termination, compensation change, hire) executes.
What normally goes wrong
Payroll is high-value, periodic and heavily automated — the worst combination. An error is discovered after money has moved to real people, when the remedy is a clawback conversation.
The decision
The signals available at the moment of the action, and the rule that judges them.
Signals
- Variance against the previous run
- Off-cycle or newly added payees
- Whether the approval chain completed
- Segregation between preparer and approver
The gate
Hold the run when variance exceeds the agreed threshold or the approval chain is incomplete, before funds are committed.
ALLOW
The run commits with the approval chain recorded.
ESCALATE
Unusual variance waits on payroll leadership.
BLOCK
The run does not commit.
Four stages left to right. Input signals — user or agent identity, context and data, tools and resources, spend and budget, policies, history and reputation, and environment — enter the Decionis Protocol. Inside, the protocol normalizes context and intent, evaluates policies and rules, runs a deterministic risk and policy engine, and explains the reason and evidence. It emits a verdict: ALLOW (authorized), ESCALATE (needs approval or more info), or BLOCK (high risk or out of policy). The verdict drives an enforcement action: allow, block, require approval, or throttle and limit. Every decision is recorded for audit, learning, and continuous improvement.
3 policies implement this pattern
Fork one and change the thresholds. Available today on 1 platform.
Workday Offboarding Access Guard
When a termination event lands, prove access and payroll were actually revoked — not just ticketed.
workday
Workday Payroll Circuit Breaker
Catches an out-of-band payroll run — a bank-detail change, an off-cycle payment, a headcount jump — before the money leaves.
workday
HR & People Ops Pack
Fairness, approval-chain, and offboarding gates — prove every hire, promotion, and termination cleared its checks.
workday
Govern this pattern with a published Zap
Start from the workflow already running in your source system. Decionis adds the policy decision and returns signed evidence without turning Zapier into the authority.
Prove it, then deploy it
A verdict you cannot check is an opinion, and a gate you cannot measure first is a risk of its own.
View the signed proof
Every verdict on this pattern produces a Decision Dossier: the signals it saw, the policy version that judged them, and an Ed25519 signature anyone can check against our published JWKS — without an account, and without trusting us.
Deploy in Shadow Mode
Run this gate against your own traffic while it stops nothing. You get the verdicts it would have returned and the actions it would have held, so the decision to enforce is made on your numbers rather than ours.
Related patterns
Teams that hit this one usually hit these next.
Related concepts
This pattern is one answer to each of these.
What to do next
The same five steps for every pattern in the library.
- Simulate this recipe
Run the policy against a realistic action in the browser. Push it past what the rules allow and watch the verdict come back. No account.
- View the signed Decision Dossier
See exactly what was decided and why: the rule that fired, the evidence it read, the policy version in force, and an Ed25519 signature you can verify yourself.
- Deploy in shadow mode
Measure what the policy would have caught on your own traffic without touching the live path. Every recipe defaults to shadow, so the first deployment carries no execution risk.
- Connect a real workflow
Point the same policy at the system where the action actually originates — a checkout, an ERP posting, a Zap, an agent's tool call.
- Share the verified result
Publish the proof: a public verification link, an embeddable badge, a PR comment, or an anonymized shadow-mode finding. This is how the next person discovers Decionis.