tldr;
Rising is over. The streamers got cleaned up. Your configuration didn't.
Workday's keynote line of the week: an agent not grounded in business rules is lawless. True. Also: the business rules are your configuration, and somebody wrote them in twenty minutes.
Lawful and accountable are different things. Lawful AI executes a policy decision perfectly and at scale, and leaves the person affected with nobody to call.
Three things I watched in Las Vegas, each one a guardrail test: a performance review that arrived pre-rated 4.5, a recruiter who shows up after the shortlist, and an agent that runs on your permissions.
Four guardrails, one line for a ticket, and the scoreboard of what you can actually turn on when your CHRO comes back asking.
Somewhere in the back half of the Kelly Clarkson set on Wednesday night, a guy near the front launched a few streamers into the crowd. Long ones. Industrial grade. Kelly Clarkson stopped mid-set to talk to him about it. She didn't know how he got those in, she said, but it was really cool. Which is the most generous security review anybody received all week.
He's gone now. The streamers were swept up before the house lights came on. Rising is a memory, the badges are in the trash (or hanging in an office), and thousands of us are back in tenants that look exactly like they did on Sunday.
Which is the point. The streamers got cleaned up. The configuration didn't.
On Tuesday morning Aneel Bhusri had stood on the keynote stage and said an agent that's not grounded in business rules might move fast, but it is essentially lawless. An agent grounded in the rules is lawful. The room liked it. I liked it.
I also knew who writes the rules.
Years ago, I built an auto-approval step into a business process. Requests under a threshold skipped human review, because the review was a bottleneck and everyone was tired of it. Took twenty minutes. I logged it as a config change.
Calling it a config change was generous. It was a policy decision about when a manager's judgment stops mattering. Nobody voted on it. Nobody debated it. It went in as a task on a sprint board, and I was the only person in the building who fully understood what it did.
That's the job. That's always been the job. What I watched last week is Workday putting that job on rails and handing it a throttle.
Lawful versus accountable
The last two posts were about other people's incentives, and all of that holds. But in talent acquisition, AI is a user problem. In HR technology, we're the plumbers.
So take the keynote line seriously, because it is the best thing Workday has said about agents and it is also a problem. Lawful means the agent follows the rules. It doesn't ask whether the rules are right. The rules are the configuration: every security group that says who deserves to see what, every condition rule that decides which humans are worth stopping for, every auto-advance that says a human's judgment isn't needed here. None of those arrived as policy questions. They arrived as tickets.
Lawful AI executes that ticket perfectly, ten thousand times a month. That's compliance with the tenant. The person on the other end is still waiting for someone accountable.
The Sunday before the keynote I sat at a table with twelve practitioners, mostly midsize shops, at the pre-Rising Share-a-thon. Three of the top twelve had signed the UMSA. Zero had an agent in production. Zero had a governance structure for an agent that goes sideways. When I asked who catches it, the best answer in the room was "hopefully Compensation."
Twelve. Three. Zero. Zero. Keep those numbers in your pocket for the next three sections.
And that table was typical. Most of the responsible-AI conversation I heard all week, on stages and over drinks, was being had by people who haven't activated one in prod yet. Nobody should be embarrassed by that. It's the finding.
Exhibit A: the review that arrived pre-rated
Sana Coach, early access as of last week. The pitch is reasonable: managers walk into feedback conversations unprepared, so let the agent assemble the signals.
The demo showed a Q1 performance review labeled "Prepared by Sana AI." The slide behind the presenter listed the inputs: GitHub, Jira, Confluence, and Slack, plus peer and self assessments. Overall rating, 4.5 out of 5, already filled in. Submit button, top right.
(Workday's own blog describes Coach more modestly, as drafting from goals, check-ins, feedback, and development activity. I'm reporting the slide I photographed.)
Here is the governance question: When that 4.5 feeds a merit cycle, who signed it? Which human's judgment does that number represent? "Prepared by Sana AI" is not a person. The manager who clicked Submit will say the system drafted it. The system will say the manager submitted it.
And notice what the agent measured: what was instrumented. Commits, tickets, wiki edits, chat. A Marketing Coordinator evaluated on her Jira hygiene. If the agent writes the review, whose judgment is the employee being evaluated on?
Exhibit B: the recruiter who shows up after
The Talent Acquisition Agent went to early adopters on Oct 13, GA planned for early 2027. The agent flow in the breakout went like this: strong candidate surfaced, application reviewed, fit explained, interview scheduled, hiring team aligned. Then the recruiter contacts the candidate and starts building rapport.
Credit where due. Workday's release says outreach still requires recruiter approval, and Kazmaier said on the record that Workday does not automate hiring decisions. I believe both. But look at where the human enters the sequence. After the review. After the fit explanation. After the scheduling.
When the human shows up after the decision, the loop has already closed. They're standing at the end of it.
One more thing from that room, and I'm raising it as a question, because it was a demo and demos lie. The surfaced-candidate card for "Eva" had her photo on it, at the stage where a recruiter decides who to look at. Maybe that's the product. Maybe it's a mock-up. Either way, what appears on the card at the moment of first impression is a configuration decision somebody makes, and it is exactly the kind of decision that never gets a policy conversation.
Exhibit C: the agent that runs on your permissions
Wednesday, the Extend session. Workday declared Developer Agent, Custom Agents, and Agent-Ready Tools generally available in what is now called Extend AI. You can build apps and agents in plain language from Claude Code, Codex, or Cursor.
The presenter typed one paragraph: build me an app for managers to nominate directs for internal mobility, show tenure, promotions in the last three years, compa ratio, kick off a BP to the manager's manager. The agent generated the pages, the WQL, a security domain called ManageNominations, a business object, and the business process. His number for the whole build: about four hours and ten minutes, including debugging. (The debugging was visible. The approver's inbox still had a "Business Process Definition Error" from the day before.)
I don't say that to dunk. Four hours to a working app in a dev tenant is remarkable. Build time collapsed. Governance time stayed exactly where it was. Security review, testing, and change control aren't in that four hours, and the agent wrote its own security domain over comp data. Your job just became reading it.
Then the part that matters most. The generated agent manifest said it recommends roles "with the worker's permission." That phrase is a sentence in a prompt. A model will usually honor it. A business process step enforces it. If your guardrail is a sentence in the prompt, it's a suggestion.
And in the Agent System of Record, the configure screen showed Execution Mode: Delegate. Workday's documentation defines it plainly: the agent performs tasks on behalf of a human and uses the worker's permissions.
Every over-provisioned security group, every stale role assignment, every "we'll clean that up after go-live" from 2019 now has an agent attached to it, moving at agent speed. Your security audit just became your AI readiness project.
The four guardrails, after Rising
One. Produce the list of decisions your system makes without a human. What it decides, as distinct from what it recommends. Auto-advance, auto-route, auto-approve, auto-reject, auto-flag, and now any agent running in Ambient mode, which the docs define as the agent performing tasks as itself. Most organizations cannot produce this list on request. The twelve at my table couldn't. Write it calmly on a Tuesday, because the version you write during an incident is worse.
Two. Ask who the worker is when an agent acts. Your business process framework assumes a human actor. Initiated by. Approved by. Delegation. Workday gave a technically complete answer last week: in Delegate mode the worker is you, and in Ambient mode it's the agent, with its own security group and a clean audit trail.
A good security admin will tell me that solves it. Transaction history shows the bot in Updated By. Traceability, done. And technically they're right, which is exactly where the argument gets missed. Logging a system account satisfies the database. When an EEOC inquiry asks which human authorized this disposition, "ISU_AI_Recruiter_Bot" is a technically complete answer and a legally useless one. Integrations move data. Agents exercise policy authority, and we have no framework concept for that.
So ask your vendor in writing, and skip "is it logged." Ask which human holds the authority the agent is exercising, and where that's recorded. Watch how specific the answer gets.
Three. Reversibility beats prevention. Some automated outcomes will be bad no matter how much you prevent. What you can guarantee is that every one is detectable, explainable, and undoable. "We need governance budget" gets you a nod. "We currently cannot undo this at scale" gets you a follow-up meeting.
Four. Somebody has to be able to answer the person. Why wasn't I advanced. Why was I rated 4.5. Why did I get flagged. If nobody can answer without saying "the system did it," you have a liability with a nice interface.
One paragraph on benefits, because the same pattern is already outside TA. In September, Workday announced Total Benefits, with benefits guidance through the Self-Service Agent expected to be GA in October. (I haven't seen the GA confirmation yet; check your tenant.) An employee asks which plan to pick and the agent answers from your eligibility rules, your plan descriptions, your life event paths. The benefits specialist who knew the dental text was three years stale is no longer standing between the config and the employee. Configuration was always policy. Now it's also speech.
The concession, and the credit
Easier said from where I sit. If you're a team of one supporting eleven modules, "inventory every automated decision" is a beautiful idea you do not have hours for. I've been the team of one. So pick the process with the highest impact, something touching pay, termination, or candidate disposition, and inventory that one.
The harder objection is standing. When a VP hands you a ticket to turn on auto-advance, you can't demand an ethics review. Correct. Ship it. And write one line in the ticket:
Automated policy delegation: Step 4 configured to auto-approve without human review. Policy owner: [name].
You still ship the config. Nothing escalates. What changes is that a policy decision now has a named owner instead of an implied one. Write it as documentation. If it reads like a shield, you've annoyed a VP for nothing.
And credit to Workday, because the plumbing is better than the keynote suggested. The Agent System of Record registers agents inactive until a human activates them. "Available To" uses the security group types you already know. The tool list is explicit (fourteen tools on the demo agent, including find performance review, which a career-advice agent doesn't need and which the builder won't trim for you). Agent Passport is in early access, GA planned by year end. And Workday signed to acquire C1.ai, an agent identity company, which tells you they know "who can press Activate" is about to be one of the most powerful questions in the tenant.
Opening the doors is right, as long as somebody's still checking IDs. The somebody is you.
The scoreboard, for the Monday your CHRO comes back
Because they will come back asking why you don't have this yet.
Available now: Sana as the new Workday Home (admins choose when to enable it). Developer Agent, Custom Agents, Agent-Ready Tools in Extend AI. Decision Intelligence. Data Cloud. Agent System of Record (GA since February).
Early access: Talent Acquisition Agent autopilot (GA planned early 2027). Sana Coach. Sana Concierge (GA expected Q1 2027). Sana in Claude (GA expected late 2026). Agent Passport (GA planned year end).
Early 2027: Workday Candidate Profile (prefills roughly 80% of the application; Workday says it doesn't rank, recommend, or reject). Payroll, Accounting, and Deployment Agent autopilot, early adopters.
Still just a number: 17 agents in production, by Workday's count. Production at Workday means something different from production in your tenant.
Most of the HR-facing agents are early access. The platform underneath them already shipped. And the governance questions live somewhere other than the roadmap: in the automated decisions already in your tenant that nobody has reviewed since the day they were configured.
Where this all lands
TA got the vivid version because the arms race is loud. TA is the preview. The point is everything after it. The same pattern is in performance now, in benefits this quarter, and it's coming for absence and comp. Every process where a model can score a human faster than a human can review the score.
In TA the accountability is diffuse. In HR technology it has a name, an employee ID, and a security group.
Responsible AI in this profession is a habit: assume you're accountable for what you make possible, and for what you decide.
Bhusri is right. An agent grounded in the rules is lawful. I still think about that auto-approval step, because it was lawful too. It followed the rules perfectly. I wrote them.
The guy with the streamers is gone. That step is still running.
Twenty minutes. Logged as a config change.
Disclosures: I spoke last week on a Rising-adjacent panel hosted by a company that sells agentic workflow software; no product names appear here and none were requested. Workday announced a partnership with Anthropic on Oct 13; Claude helped me fact-check this issue, so weigh any Anthropic-adjacent analysis accordingly.
— Mike
Director HR Tech | Wrote the Laws on a Tuesday
P.S. Justin's 3D Lab ran the capture infrastructure for Rising: one QR tag on my backpack strap, an embossed logo on the back. Final tally: 91 scans. Six new subscribers during the week. And no way to attribute the six to the tag, because the UTM configuration was mine, I did it in about twenty minutes, and I'm told it was a config change. Unless there's an argument from the community, he's getting the win. Ninety-one people scanned a tag a twelve-year-old printed and I didn't see a single one of them do it, which is the most honest description of an automated process I heard all week.
P.P.S. Spreading Rising across three casinos was a lot. I spent most of the week shuffling between Caesars Forum and the Venetian, and one day I Ubered down the Strip for a day at Resorts World. San Diego is one convention center, and I'm holding them to it. Happy to report the titanium held up. My ego did not.