tldr;
At the Share-a-thon before Rising, I asked twelve practitioners one question: when an AI agent goes wrong six months after go-live, who catches it? The best answer in the room was "hopefully Compensation."
The numbers: 12 in the room, 3 had signed the UMSA, 0 had agents in production, and 0 had a plan for an agent that goes sideways.
The orgs that do have AI councils built a gate. They run a heavy approval up front, and then nobody looks at the agent again. That's how a good agent quietly turns into a bad one.
Workday shipped real pieces of a leash at Rising. Nobody at this table had a hand on it yet.
Also: the room cared more about Flex Credits than about governance. I'm counting that as a finding.
Two weeks ago in Las Vegas, I asked twelve people a question and then sat on my hands.
That was the whole design. Eighty percent of the talking was theirs and twenty percent was mine. No slides. A notepad, a prompt, and a promise at the end: I'd write up what the table said, with no names and no companies.
This is that writeup. (It's late. See the P.S.)
The table
Twelve practitioners from midsize to large shops, mostly in the 6,000 to 10,000 employee range. The industries were mixed, and one was a law firm, which made the governance conversation livelier than it had any right to be. Most of them already read this newsletter. So I was facilitating a room full of people who knew my opinions and came anyway, which I appreciated.
I opened with a go-around: "Where is AI actually live in your tenant today? Not on the roadmap. Live."
3 of 12 had signed the UMSA.
0 of 12 had agents in production. Two were testing in sandbox, and everyone else was at sandbox or earlier.
0 of 12 had a governance structure for an agent that goes rogue.
Hold that second number up against the keynote. On stage the count was seventeen agents in production. At this table it was zero. Both numbers are true. The first one measures what Workday has built, and the second one measures what customers have actually put to work. The distance between them is the job of everyone reading this.
Twelve people is a small sample, and I'm not going to dress it up as a survey. But given how hard Workday pushed "sign the UMSA" from the keynote stage, I'd bet this table was ahead of the average customer, not behind. That makes those two zeros worse, not better.
Who catches it?
Round two was the prompt I'd been saving: "An agent recommends something, and it goes wrong six months from now. Walk me through who catches it in your org."
The table went silent. I had told myself to let the silence do the work, and it did, for an uncomfortably long time.
The best answer was "Hopefully Compensation." To that person's credit, they followed it right away with "...and we need guardrails to make sure that happens."
If you read the Tuesday-morning post in August, you know where this goes. In that scenario an AI suggests a comp range, twenty people nod it through, and six months later there's an equity problem nobody can trace. When I wrote it, it was a hypothetical. Sitting at this table, it wasn't anymore. A room of honest, competent practitioners told me plainly that their plan for catching a bad agent was hope.
I don't think less of anyone for that answer. I think more of them. Most tables would have bluffed.
A gate, not a leash
This is the finding I didn't walk in with.
Several of these orgs do have AI councils, real ones with charters and recurring meetings. Every person who described one described the same shape. There's a long, rigorous approval process at the front end. The agent gets approved and eventually goes live. After that, nobody looks at it again.
That's a gate. A gate is good at exactly one moment, the moment something comes in. It answers "should this agent exist?" It has nothing to say about "is this agent still doing what we approved?"
The second question is the one that hurts you. The business changes (a reorg, a new comp philosophy, a labor market that moves) and nobody tells the agent. The agent was right in March. In September it's still confidently right about a world that no longer exists, and the council that approved it has moved on to approving the next one.
A leash works differently. Someone is holding it every day, so when the agent starts pulling somewhere it shouldn't, a person feels it.
Right now, governance is a gate. It needs to be a leash.
Workday brought part of the leash
Here's the concession, and I mean it. Rising had more real governance material than I expected.
The Agent Management Hub works as a kill switch for a single skill or an entire agent.
New audit reports cover agent accounts, security for agent skills, human-and-agent interaction logs, and an agent audit trail.
Delegate agents can't do more than the person who asked, and they can't raise their own privileges.
You decide where human approval sits, based on risk, the type of action, and whether it can be undone.
One stat from the sessions stuck with me. Workday's own research found that six foundation models flagged a missing source only 25% of the time, and they answered confidently either way. In the example, an agent reused last month's per diem rate without mentioning it. (Hat tip to Incubane's Rising session digest for pulling this together.)
No gate catches that. You catch it only if someone is reviewing what the agent actually produced.
So the tooling for a leash exists or is on its way. Workday spent the whole week calling it "lawful" AI, and that's fair: the rules are built into the platform. But rules alone don't make anyone accountable. Accountability takes a person whose name is on the review, and at this table, nobody's was yet.
What the room actually wanted to talk about
Flex Credits. Honestly, the room cared about this more than governance, and I'd be shading the writeup if I pretended otherwise.
They had two objections. The first was unpredictable spend. The second was "we already pay Microsoft for this," with Azure and a couple of other AI vendors usually added to the list. Everyone at the table was confused about how Flex Credits work. Then it turned into a customers-comparing-notes moment, because most of the room didn't know whether their base allocation was negotiable at all.
I'm not going to tell you what your contract says. I am going to tell you to ask your account team, in writing, before your renewal conversation starts instead of during it.
My read is that the spend question and the governance question are the same question. Until customers can see the guardrails and understand how they're managed, the AI budget stays where it already is.
One more quick note: the Deployment Agent got a pass from the table. People testing it reported that it invented tasks and business processes that don't exist. Every case surfaced in testing. Credit where it's due, though: that's the gate doing its one job.
Monday morning
The room's consensus came down to two things: get in front of this with IT now, and put approved agents on a review cadence so they can't drift. Here's how I'd build on that.
Crawl: List every AI capability (and automatic approval) turned on in your tenant, including sandbox. Next to each one, write a name. A specific person, not a council.
Walk: Meet with IT before your first agent goes live, not after the first incident.
Run: Review every approved agent at least quarterly. Pull ten outputs. Check them against what the council approved, and check whether the business assumptions behind the approval still hold. Use the audit reports Workday just shipped, because that's what they're for.
Then write down your rollback plan before you click Activate. The worst time to design one is right after you discover you need it.
A gate asks permission once. A leash asks every day.
— Mike
Director HR Tech | Holding the Leash, Two Weeks Late
The Department of First Things First. For the people who do the work.
P.S. In "Your Room Is Gold" I told a room of RUG leaders that attention you don't capture within 24 hours is gone. This writeup is fourteen days late. To the twelve of you: thank you for not unsubscribing in the meantime. The recap promise still stands. The 24-hour part is now aspirational.