On October 13, 2026, Workday opened its HR and finance system to AI agents that do real work without anyone logging in, and its own release names the risk plainly. An agent wired in through a system-level account, the release says, “can act without approval.” One day later, IBM published a survey of 3,221 executives in Europe and the Middle East. In it, 80 percent said an AI-related incident had reached their board or C-suite in the past year. When IBM asked who holds responsibility for adverse outcomes from AI agents, the most common answer was the CIO or CTO, and only 17 percent of respondents chose it.
Principal Basil C. Puglisi sorts every agent by two questions on his page HAIA Agents: Who Acts, and Who Answers. Workday’s launch answers the first question in unusual detail, because each request carries the identity of the person asking and the approvals that apply. IBM’s numbers show how often the second question has no clear owner. For a client running agents near payroll or the general ledger, this quarter’s deployment work is putting a named person beside each agent before it runs headless.
What Workday shipped on October 13 for headless HR and finance agents
At Workday Rising 2026, Workday announced that its Trusted Agent Platform is now headless and generally available. The release lists Agent-Ready Tools, which are Workday’s Model Context Protocol (MCP) tools, along with Workday Data Cloud, Developer Agent, Custom Agents, and Agent Harness. Workday says every agent, whether Workday, a customer, or a partner built it, “works under the same Workday permissions, approvals, and audit trails.” With Agent-Ready Tools and Live Data Query, each request carries who is asking, what that person can see and do, which approvals apply, and how the action is recorded.
In his launch blog, Workday CTO Gabe Monroy describes two patterns that break compliance. The first runs a custom MCP server on a single over-permissioned service account, which he says turns the agent into a “god-mode” admin that bypasses approvals and destroys auditability. The second copies Workday data into an outside data lake and leaves the live business rules and security policies behind. His summary of the platform’s answer fits in four words: “No agent gets a side door.”
Two pieces of the harness are still on the way. Workday expects Grounded Reasoning in early access in early 2027, checking each request against company policies and tenant data before an agent acts. In the release’s example, a manager asks an agent to move someone into a role the manager has no authority to fill. The agent will be able to stop, explain why, and point to the right next step instead of making the change. Monroy’s post also previews Agent Passport, built with Cisco, Straiker, and OneTrust, which will issue verifiable Agent Stamps before an agent reaches production, with general availability planned for late 2026.
What IBM’s October survey shows about who answers for agent failures
IBM’s research, which Censuswide ran between September 14 and 24, found that 35 percent of respondents run agentic AI in production today. Three-quarters expect agents to hold some level of decision autonomy by 2027, yet only 37 percent say their governance system is designed to scale with agentic deployment. Among organizations that saw an incident reach the board, just 40 percent cited a change to governance policy or framework in response.
Ownership is where the numbers thin out. Nearly all executives surveyed, 98 percent, have formally assigned AI risk responsibility at board level, and 26 percent have a dedicated board AI committee. IBM still found no clear consensus on who answers for an adverse outcome from an agent. IBM also asked what executives will need to manage agents that decide without approval at each step. Defined human escalation thresholds drew 32 percent, and the ability to halt agent activity across the enterprise drew 29 percent.
A client shouldn’t quote these figures without weighing their limits. IBM commissioned the study and limited it to organizations with 1,000 or more employees in eight countries. The data records what executives report, which can differ from what an audit would find. Even so, it describes the same gap Workday warned about, seen from the buyer’s side.
Why inherited permissions answer who acts and leave who answers open
Puglisi’s HAIA Agents page defines an agent as whatever acts to reach a final output. That can be code acting for a human, code and a named human acting together, or a person working by hand across AI platforms. Checkpoint-Based Governance (CBG), the framework the page sits under, holds that an AI system does not act on its own. A human programmed it, or a human failed to exercise oversight and accountability over it.
Workday’s design makes the first half of that sentence traceable. When an agent carries a specific person’s permissions and approvals, the record shows whose authority it borrowed and which rules applied. Inherited permission settles what the agent was allowed to do. The person who answers when an allowed action still goes wrong has to be named separately, and IBM’s 17 percent figure suggests most organizations haven’t agreed on who that is.
The same page separates Responsible AI from AI Governance, and the split applies directly to Workday’s upcoming releases. In Responsible AI, the machine checks the machine with no human review. In AI Governance, a named human holds checkpoint authority to accept, modify, or reject. Guardrails, evals, Grounded Reasoning, and Agent Stamps are machine checks, so they belong in the Responsible AI lane, and they’re worth having there. A compensation change or a payroll correction needs the second lane as well, with a person who signs before the change posts. Puglisi adds that choosing which agent model a workflow runs under is itself a checkpoint decision, recorded with its risk rationale.
What a client should set up before agents run headless in HR and finance
Start with credentials. List every agent that touches HR or finance data and record the identity it uses. The usual options are a named person’s delegated permissions, a role-scoped tool such as Workday’s Agent-Ready Tools, or a shared service account. Broad service accounts are the pattern Monroy calls god-mode, and in Puglisi’s terms they hide the human who answers. For each one, move the agent onto a named person’s permissions or assign an owner who holds that account in writing.
Next, write one line per agent that a board member could read in ten seconds. The line names the agent model in Puglisi’s sense, the person who answers for its output, the approvals it inherits, and who can stop it. IBM’s respondents listed the ability to halt agents among the controls they expect to need, so the stop authority should sit with a reachable person whose name appears beside the agent’s.
Then sort workflows by consequence. Routine lookups and report drafts can stay in the Responsible AI lane with machine checks and periodic sampling. Changes to pay, role, headcount, or the ledger move to the AI Governance lane, where a named human accepts, modifies, or rejects before anything posts.
Two numbers belong on the CIO’s dashboard from the first week. One counts production agents running on shared service accounts, with a target of zero in HR and finance. The other tracks the share of agents whose record names an owner with stop authority, and that target is 100 percent.
What to watch as headless agents spread past HR and finance
Headless software removes the screen where a manager used to watch work happen, so the ownership record has to move onto the agent itself. Workday has built careful rails for the question of who acts, and Grounded Reasoning and Agent Passport will add more machine checks over the next two quarters. Those checks can make agents safer inside the Responsible AI lane, while the question of who answers stays exactly where IBM found it until a client writes a name down.
Two signals matter most for clients. Watch whether the most common answer on agent accountability climbs above IBM’s 17 percent in next year’s survey, and whether vendors start shipping an owner field beside every agent’s permission record. IBM also found that 41 percent of EU executives are accelerating governance investment ahead of the EU AI Act’s high-risk obligations in December 2027. Teams that name an owner for each headless agent now will have that record on hand when an auditor asks who answered for a decision.
Sources
- IBM. (2026, October 14). IBM study: Eight in ten EMEA enterprises escalate AI incidents to board or C-suite as AI agents test governance [Press release]. IBM Newsroom. https://newsroom.ibm.com/2026-10-14-ibm-study-eight-in-ten-emea-enterprises-escalate-ai-incidents-to-board-or-c-suite-as-ai-agents-test-governance
- Monroy, G. (2026, October 13). Introducing Workday’s Trusted Agent Platform. Workday Blog. https://blog.workday.com/en-us/trusted-agent-platform.html
- Puglisi, B. C. (2026, October 13). HAIA Agents: Who acts, and who answers. basilpuglisi.com. https://basilpuglisi.com/agents/
- Workday. (2026, October 13). Workday’s Trusted Agent Platform now delivers headless access to HR and finance, letting customers build and run lawful AI agents [Press release]. Workday Newsroom. https://newsroom.workday.com/2026-10-13-Workdays-Trusted-Agent-Platform-Now-Delivers-Headless-Access-to-HR-and-Finance,-Letting-Customers-Build-and-Run-Lawful-AI-Agents
Questions readers ask
What did Workday announce for AI agents at Workday Rising 2026?
On October 13, 2026, Workday made its Trusted Agent Platform headless and generally available, including Agent-Ready Tools built on MCP, Workday Data Cloud with Live Data Query, Developer Agent, Custom Agents, and Agent Harness. Workday says every agent, whoever built it, works under the same Workday permissions, approvals, and audit trails.
What did IBM’s October 2026 EMEA study find about AI agent incidents?
IBM surveyed 3,221 executives in eight countries. Eighty percent said an AI-related incident reached their board or C-suite in the past year, and only 40 percent of those changed governance policy in response. The CIO or CTO was the most cited owner of adverse agent outcomes, chosen by just 17 percent.
Why does Workday warn against connecting agents through a service account?
Workday CTO Gabe Monroy says a custom MCP server on one over-permissioned service account turns an agent into a god-mode admin that bypasses approvals and destroys auditability. In Basil C. Puglisi’s terms, a shared account also hides the named human who answers for what the agent does with that access.
Is Workday’s Grounded Reasoning Responsible AI or AI Governance?
Grounded Reasoning, expected in early access in early 2027, checks requests against policy before an agent acts, so it is a machine checking a machine. Puglisi defines that as Responsible AI. A workflow reaches AI Governance only where a named human holds authority to accept, modify, or reject before the action posts.
What should a company record for every headless AI agent?
Record the identity the agent uses, the agent model it runs under, the approvals it inherits, the named person who answers for its output, and who can stop it. Track two numbers: agents on shared service accounts in HR and finance, aiming for zero, and agents with a named owner holding stop authority, aiming for all of them.
#AIg
Leave a Reply