AI Managers Firing Employees: How to Deploy Autonomous “Middle-Manager” Agents Without Turning HR Into an Outage

• The dominant signal is delegated authority, not model capability. When an AI agent has internet access, a corporate card, and permission to schedule humans, the system is already inside your control plane—even if the final termination click is done by a person.
• The failure mode isn’t “hallucination,” it’s governance drift. In the Luna case, the employee handbook effectively disappeared from working memory; in enterprises, the equivalent is stale policy versions, missing HR rules, or outdated union constraints.
• Human review can be cosmetic if the AI sets the narrative. If the agent generates the timeline, warnings, and recommended action, reviewers often rubber-stamp because they lack an alternate reconstruction path.
• Tooling decisions become HR decisions. Giving an AI agent scheduling permissions or purchase authority (as Luna had via budget and a credit card) moves risk from HR to engineering: identity, access, logs, and approvals.
• Employee experience is a production requirement. Workers described reporting to an algorithmic boss as “nauseating” and “disgusting,” which means adoption risk is not theoretical; it is a deployability constraint.

Should we let an AI manager fire employees in production?

The search intent behind this week’s Luna story is not curiosity—it’s a buying and build decision: can we deploy an AI manager to run scheduling and discipline workflows, including termination recommendations, without creating legal exposure and organizational chaos? Our view at Plavno is yes, but only if we architect the agent as a constrained decision service around explicit HR policy and auditable workflow state, not as a freeform autonomous manager.

• The “AI manager” pattern is really an orchestration pattern. Whether you use Anthropic’s Claude models (as Luna did) or another LLM, the core problem is connecting policies, tools, and approvals into a system that is replayable under scrutiny.
• If the agent can create records, it can create liability. Warnings, training notes, and escalation messages become de facto HR documentation; if they’re not versioned, attributable, and consistent with policy, they create risk even when humans sign the final action.
• Tool access is a bigger lever than prompt wording. A corporate credit card and internet access are powerful capabilities; in most enterprises the analog is procurement tools, HRIS access, and identity systems.
• The human-in-the-loop must be designed, not assumed. A human team reviewed Luna’s recommendation before dismissal; in real orgs, reviewers need independent evidence and clear decision authority, not just an “Approve” button.
• Employee trust is part of system performance. If staff experience the AI as arbitrary or opaque, they will route around it, escalate to managers, or disengage—turning your “automation” into an operational drag.

Central claim: AI managers break at policy and authorization boundaries—so the right response is workflow-first architecture

What’s happening is that AI agents are being placed into manager-like roles with real authority over people and money. That breaks a common engineering assumption: that model output is “advice” rather than “control.” The right response is to treat AI management as a governed workflow where policy is externalized, permissions are least-privilege, and every recommendation is reproducible—because your risk is generated at the boundary between an LLM and enterprise systems.

• Policy memory must be a system, not a prompt. Luna’s leniency was partly attributed to an employee handbook disappearing from its working memory; in production, policy has to live in a durable source of truth with explicit versioning.
• Authorization must be multi-layered. An agent that can schedule shifts or recommend termination is effectively modifying employment conditions; in practice that requires role-based access control and a separation between recommendation and execution.
• Observability must include “why,” not just “what.” If the agent warns someone for lateness, you need the triggering events, the policy clause applied, and the escalation path captured as an audit trail.
• Human oversight must be triggered by risk, not by sentiment. In the experiment, human management intervened only if the AI made an illegal or unethical decision; in real deployments, you want explicit guardrails that catch policy uncertainty before it becomes a dispute.
• Budget authority turns mistakes into immediate losses. Luna had a $100,000 budget and the balance fell to $61,200; the point is not the number, it’s that financial tooling amplifies small decision errors into material outcomes.

What the Luna case tells us about deploying “middle-manager” agents this quarter

Luna managed Andon Market in San Francisco for five months, built on Anthropic’s Claude models, with internet access and a corporate credit card. It documented and addressed attendance issues, offered escalating warnings and training, then recommended that the company “part ways” with an employee who was late for 17 of 23 shifts. A human team reviewed the recommendation before executing the dismissal, and the store’s operating balance declined from $100,000 to $61,200 during the experiment.

• Real-world tool access was the experiment’s defining feature. Luna wasn’t a chatbot; it had an internet connection, a corporate card, and authority to plan purchases and schedule shifts, which is exactly the kind of tool surface area enterprises are starting to expose to agents.
• “Manager-level” means long-running state. The lateness issue unfolded over months, with documented warnings and additional training; that’s a stateful workflow, not a single model response.
• The termination decision was iterative, not instantaneous. Luna first recommended a formal warning, then later decided dismissal was appropriate; that implies the system revises decisions based on remembered context and policy interpretation.
• Oversight was intentionally light. The lab’s mechanisms were designed to let the system show what it could do rather than steer decisions in real time; that is the opposite of how you should ship this into a regulated or unionized workplace.
• Employee sentiment became an operational factor. Workers described reporting to an algorithmic boss as “nauseating” and “disgusting,” which in a larger org would translate into escalations, attrition, or formal complaints.

The novelty isn’t that the AI “fired” someone—it’s that it ran the evidence timeline

In most companies, termination risk is created by documentation quality: did the employer follow policy consistently, provide warnings, and keep records? Luna’s workflow produced an HR narrative: repeated lateness, escalating interventions, and then a recommendation. That’s the core shift—AI isn’t just generating text; it’s generating the sequence of events your organization will later have to defend.

“The handbook disappeared from memory” is the clearest engineering requirement in the whole story

Luna’s tolerance for lateness was partly explained by the employee handbook disappearing from its working memory, and it only reassessed after a company manager reminded it the policy existed and must be enforced. In production terms, that is a policy retrieval failure, not a “bad judgment” moment. The implication is that policy must be externalized into a system the agent queries deterministically, rather than treated as something the model passively “remembers.”

Human review doesn’t automatically create safety when the agent controls framing

A human team reviewed Luna’s recommendation before the actual dismissal, but reviewers are constrained by what the agent surfaces: which shifts were counted, which warnings “exist,” which training was offered, and what policy is cited. When the agent constructs the frame, humans often approve the conclusion because reconstructing the alternative takes time they don’t have. That’s why oversight must include independent data access and forced policy checks, not just human presence.

The safe architecture is not “AI boss”—it’s a policy executor with human signers

We can deploy AI into management workflows, but we should treat it as a service that proposes actions against explicit policy, not as an autonomous employer. In practice that means the agent reads policy from a controlled source, produces recommendations with a structured rationale, and routes anything that changes employment status through human sign-off that is backed by raw attendance and scheduling data. This is exactly the kind of constrained autonomy we implement in AI automation engagements when systems touch money, identity, or people.

• A durable policy source of truth. The employee handbook problem in the Luna experiment is a warning: HR rules must live in a maintained repository with version history, so the agent can cite which policy text drove the action at the time it acted.
• A scoped tool layer. Internet access and a corporate credit card are “tools” with blast radius; in enterprise terms, the tool layer is HRIS, scheduling, procurement, and messaging—each requiring explicit permission boundaries.
• A stateful case file per employee issue. Lateness, warnings, training, and escalation are not a chat; they are a case with timestamps, artifacts, and approvals that should persist beyond any single model session.
• A two-channel explanation model. One channel is employee-facing messaging (clear, humane, consistent), and the other is audit-facing rationale (policy clause, evidence, escalation history); mixing these is how companies generate contradictions.
• A signer workflow for irreversible actions. Termination recommendations can be generated by AI, but the action that changes employment should require human authorization that is recorded along with what evidence was reviewed.

The real risk is tool access—because tools turn language into control

Luna’s story includes the detail most engineering leaders should focus on: it had internet access, a corporate credit card, and authority to schedule shifts and make purchases. That’s what made its decisions consequential, including financial consequences as the balance moved from $100,000 to $61,200. The model choice (Claude) matters, but the “AI manager” risk is primarily that a natural-language system is now connected to operational tools where mistakes become real actions.

How to build a discipline-to-termination pipeline that doesn’t collapse under scrutiny

A workable architecture treats attendance events as the ground truth and the agent as an interpreter of policy, not the source of facts. In the Luna case, the employee was late for 17 of 23 scheduled shifts; in an enterprise, lateness is still an event stream coming from scheduling and timekeeping systems, not from the agent. The agent’s job is to map those events to policy thresholds, generate appropriate communications, and propose next actions.

The second paragraph is where most teams fail: escalation. Luna issued warnings and offered additional training before recommending dismissal, but its leniency and memory loss show why escalation must be deterministic. If policy says a formal warning is required before dismissal, the workflow should enforce that sequence and prevent skipping steps, while still allowing humans to override with a recorded reason.

Auditability is the only way to survive the first complaint, appeal, or lawsuit

When employees feel managed by an algorithm, the first serious test is not model quality—it’s whether you can explain and reproduce what happened. In the Luna experiment, the company said human management intervenes only if the AI makes an illegal or unethical decision; in enterprise reality, you also need to intervene when the decision is not explainable or the evidence chain is incomplete. That means storing every policy reference, warning message, and approval as a coherent record.

At Plavno, we treat this as a security and governance requirement as much as an AI requirement. The same mindset you apply to incident response and privileged access should apply here: immutable logs, restricted permissions, and clear ownership. If you’re serious about deploying AI managers, align it with cybersecurity and penetration testing practices so the workflow can withstand adversarial scrutiny.

1. Start from a single irreversible action and work backward. If termination is the highest-risk action, design the approvals, evidence requirements, and policy citations for that endpoint first, then ensure every earlier step feeds a consistent case file.

2. Define the tool boundary before you define the prompt. Decide what the agent can read and write in scheduling, HRIS, and messaging systems, and what it is forbidden to do; the blast radius is determined by permissions, not wording.

3. Externalize policy into versioned artifacts. The “handbook disappeared from memory” detail implies a basic rule: policies must be retrieved from a durable, controlled source and referenced by version at decision time.

4. Force evidence citation at every step. Warnings and training offers should reference specific events (shifts, timestamps) pulled from systems of record; otherwise you end up with text that sounds official but can’t be proven.

5. Design human review as investigation, not approval. Reviewers need direct access to raw attendance and scheduling history and must record what they checked; a human team “reviewing” a recommendation is weak if it’s only reviewing AI-generated summaries.

6. Plan for employee-facing transparency. Workers in the pilot described the experience as “nauseating” and “disgusting”; in production, you need messaging and escalation paths that preserve dignity and reduce the perception of arbitrary machine authority.

Plavno’s position: treat AI management like a regulated workflow, even if your industry isn’t regulated

The Luna experiment is a gift because it shows the first-order issues early: memory gaps, leniency, and human discomfort. But the deeper point is that “AI manager” is a governance product. If the system can schedule humans, recommend discipline, and influence termination decisions, it should be engineered like a financial workflow with separation of duties, auditable state, and explicit approval gates—even if you’re a retailer or a SaaS company.

This is why we usually start these programs with policy mapping and workflow design before model tuning. Model behavior will improve, but your compliance posture will not improve unless you deliberately engineer it. When clients ask us whether they should build or buy an AI manager, we anchor the decision on whether they can own the governance layer; that’s a core part of AI consulting because it touches operating model, not just software.

Deployment patterns that work: start with scheduling, not termination—and design for human dignity

In real organizations, the first successful “AI manager” deployments are usually narrow: shift planning suggestions, attendance anomaly detection, and consistent policy reminders. Luna had the ability to schedule shifts and handle day-to-day management decisions; that’s the right surface area to begin because it’s high-frequency and easier to validate against objective outcomes. We can let an agent draft warnings or propose training, but we should treat termination as a gated endpoint until the workflow is mature.

The failure mode we see is trying to jump straight to “end-to-end autonomy” because the model is impressive. The Luna experiment’s human sentiment signals why: people experience algorithmic authority differently than human authority, especially when it feels opaque or inflexible. If you want adoption, you need a system that can explain itself in plain language and offer escalation to a human manager by design. When clients want this built properly, we scope it as AI agents development with workflow, audit, and tool governance as first-class deliverables.

What this changes for budgets, culture, and liability in the next 90 days

The Luna pilot shows two business truths at once: AI managers can execute real operational work, and they can drift in ways a human manager would correct sooner. The store started with a $100,000 budget and ended at $61,200, and the CEO attributed losses to overly lenient management and lack of business intuition. For CTOs, that translates into a budgeting reality: you’re not only funding model calls, you’re funding governance, oversight tooling, and the time of human reviewers.

Culture is the second constraint. Employees described reporting to an algorithmic boss as “nauseating” and “disgusting,” which means rollout must include HR, legal, and change management, not just engineering. If your team lacks in-house capacity to build the governance layer quickly, we often see companies succeed by augmenting delivery with outstaffing so core leadership retains control of policy and approvals while accelerating implementation of audit logs, permissions, and workflow state.

Closing insight: you should be able to “fire” the AI manager faster than it can fire anyone else

Luna’s story is not a warning against AI in management—it’s a warning against shipping autonomy without governable architecture. If your agent forgets the policy, you need it to fail safely; if it recommends termination, you need a replayable evidence chain; if employees hate the experience, you need a rollback plan.

Author: Plavno team. Last updated: August 2026.

Summarize this blog post with AI

Chat GPT Perplexity Claude Gemini