Can Leave Request Status Be Reported Without Deciding Entitlement?

Research question: which leave-request states a coordinator can report without inferring entitlement, medical facts, approval, or payroll treatment for a Philippines-based worker? This protocol examines a narrow administrative evidence problem. It does not make an employment, legal, payroll, security, hiring, benefits, or performance decision.

Why this matters to a staffing buyer: A staffing buyer may see received, complete, approved, scheduled, and paid used as though they mean the same thing. They do not. A request can be received but incomplete, approved but not reflected in a roster, or scheduled while its payroll effect remains unresolved. A status model should expose those gaps without turning the coordinator into the decision maker.

Evidence basis: the Philippine Data Privacy Act and its implementing rules establish principles including transparency, legitimate purpose, proportionality, accountability, security, access, and retention. National Privacy Commission materials describe the responsibilities surrounding personal-data processing. DOLE materials provide labor-context references. NIST CSF 2.0 and SP 800-53 provide governance, identity, access, audit, personnel-security, and record-integrity concepts. These sources frame a test; the responsible organization must determine its actual duties.

Unit of analysis: one dated leave request moving through one owner-approved workflow. Fixing the unit before review prevents an attractive batch total from concealing one unresolved person, permission, record, or decision. Every unit receives a stable non-identifying reference.

Method: construct eighty-five synthetic requests including ordinary annual leave, partial days, overlapping dates, corrected dates, withdrawn requests, missing evidence, restricted evidence, manager absence, disputed balance, schedule conflicts, retroactive submissions, public holidays, and a payroll update that failed after approval. Use invented people, organizations, dates, values, and identifiers only. A study administrator retains the seeded answer key separately until reviewers finish their first classifications.

Required evidence fields: request reference, received event, requested dates and timezone, request category, checklist version, restricted-evidence indicator, completeness state, required decision owner, decision event, schedule acknowledgment, payroll handoff, correction history, exception, and next action. Each field must have a stated business purpose and authoritative source. Blank, unknown, not applicable, restricted, and not yet received remain different values; none may be translated into approval or completion for convenience.

Before testing, the responsible owner writes the accepted states, required evidence, role permissions, response windows, escalation path, and stop conditions. Freeze those definitions for the first pass. If a rule changes, version it and rerun affected cases instead of rewriting earlier results.

Primary measure: accurate state classification and routing without an unsupported conclusion about entitlement or pay. Secondary measures include false approval, private-data leakage, wrong-date conversion, stale balance use, missed downstream update, overwritten correction, and unresolved age. Reviewers cite the exact event supporting every classification and use cannot determine when evidence is insufficient. A confident guess counts as an error even when it accidentally matches the answer key.

Error taxonomy: Received is not complete; complete is not eligible; a manager calendar entry is not necessarily approval; approval is not proof that roster and payroll systems were updated; and an absence observed after the fact does not establish the correct leave classification.

Decision boundary: The coordinator may log receipt, compare observable items with an approved checklist, issue approved reminders, record authorized decisions, reconcile downstream acknowledgments, and route exceptions. HR, the designated manager, payroll, and authorized advisers retain entitlement, evidence sufficiency, balance, pay, accommodation, dispute, and policy decisions.

Comparison design: Compare a multi-state event record with a single mutable status label. Also compare a restricted source link plus exception code with copying medical or family narratives into a general leave tracker. Give reviewers the same underlying cases in randomized order. Compare correctness, unnecessary access, unresolved work, serious errors, and review time rather than measuring speed alone.

Privacy and security treatment: Use fictional workers and masked evidence. The coordination layer should record that restricted material exists and who may review it, not reproduce its contents. Check email subjects, calendar visibility, exported rosters, notification previews, backups, and retention behavior. Record who viewed, exported, notified, or changed evidence because a restricted main screen does not prevent a downstream copy from exposing the same data.

Negative controls are essential. Include ordinary cases that should proceed, incomplete cases that should stop, and misleading cases containing a plausible but insufficient signal. A process that never stops is uncontrolled; a process that stops every case is not useful.

Analysis plan: Calculate classification and routing accuracy by transition. Report disclosure events, entitlement guesses, and missing downstream acknowledgments as separate failure classes. Preserve approved extensions and owner delays rather than relabeling them as worker delay. Two reviewers independently classify an overlapping sample. Preserve disagreements, categorize their causes, and send them to the named owner. Do not average disagreement away or let the first data entry become the answer by default.

Set quality thresholds before opening the answer key. The owner defines acceptable routing accuracy, maximum unresolved age, serious-error classes, and pilot stop conditions. A faster workflow fails if it increases unauthorized decisions, disclosure, false closure, or loss of provenance. Publish counts and denominators for every result, including exclusions and their reasons.

Run a repeatability check after the first review. A second reviewer receives the written definitions and clean cases, without coaching from the first reviewer. Low agreement may show an ambiguous rule, weak source, or missing state. Clarify the rule, record a new version, and retest the affected cases before live use.

Provider evidence should match the proposed operating model. Buyers can request a sanitized role demonstration, blank register, permission view, escalation map, and sample audit export. Each artifact has a date and scope. A policy, sales statement, or successful demonstration does not establish continuous operation; missing evidence stays an open question.

Separate fact, classification, decision, and inference in the result. A source event is an observed fact. Applying a frozen rule produces a classification. An authorized owner may make a decision. Researchers may then infer where the workflow is fragile, but that inference must be labeled and cannot be presented as a measured live-company outcome.

Uncertainty should remain visible. Missing events, ambiguous definitions, unavailable owners, integration delays, inaccessible evidence, and contradictory sources receive explicit codes. Report waiting time separately from active processing time so an external dependency is not mistaken for coordinator performance.

Limitations: The protocol cannot interpret Philippine leave law, company policy, medical evidence, collective agreements, or a specific worker’s rights. Synthetic requests omit emergencies, contested facts, accessibility needs, and informal manager promises. A live pilot should begin with a small approved queue, named reviewers, least-privilege access, monitored exceptions, and a stop rule for unexpected sensitive information or decisions outside the written lane.

Decision use: The decision-grade output is a leave event timeline that separates receipt, observable completeness, owner decision, schedule update, payroll acknowledgment, correction, and unresolved exception. Buyers can ask a provider to demonstrate the record with sanitized cases. That demonstration is point-in-time evidence, not a guarantee of compliance, accuracy, security, or employment outcomes.

Sources checked September 23, 2026: National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012 (https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/); National Privacy Commission, Republic Act 10173 – Data Privacy Act of 2012 (https://privacy.gov.ph/data-privacy-act/); Department of Labor and Employment Bureau of Working Conditions, Labor Advisories (https://bwc.dole.gov.ph/issuances/labor-advisories/); National Institute of Standards and Technology, Cybersecurity Framework 2.0 (https://www.nist.gov/cyberframework); National Institute of Standards and Technology, Security and Privacy Controls for Information Systems and Organizations, SP 800-53 Revision 5 (https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final). These primary government sources provide privacy, labor-context, governance, access-control, and audit concepts. They do not decide a specific employment matter, certify a provider, or replace advice from authorized legal, HR, payroll, security, or benefits owners.