On October 29, 2026, Amazon Web Services made existing business workflows callable by AI agents. In the AWS announcement, Step Functions workflows become tools that agents reach through Amazon Bedrock AgentCore Gateway, and AWS describes the split plainly: “Your agent decides when to run a workflow and what input to pass, and Step Functions runs each step exactly as you defined it.” The example AWS gives is a refund. A support agent starts the refund workflow, and Step Functions runs the eligibility check, the manager approval and the credit steps “so every refund follows your policy.”
Basil C. Puglisi described a similar division of labor in March 2026. His GOPEL v1.5 paper lays out GOPEL, his governance layer for multi-AI workflows, which “governs but does not think,” because “pipes that can think can be manipulated.” The same paper puts the setup decision before any work starts, saying that choosing the agent operating model “is a CBG decision made by the human arbiter before any workflow begins,” with CBG standing for his Checkpoint-Based Governance. The AWS launch gives the fixed steps to the workflow and the judgment about when and with what input to the agent. A client deploying it has to make the decision Puglisi places first, which is which workflows the agent can reach at all.
Three vendors opened business workflows to agents in two days
AWS was one of several vendors that week. On October 28, ServiceNow and OpenAI expanded their partnership with a ServiceNow plugin for ChatGPT, available in the OpenAI marketplace the same day. OpenAI’s announcement says customers connect ChatGPT to their own ServiceNow instance “and choose which capabilities to make available,” while ServiceNow’s Action Fabric applies existing business rules and permissions. A ServiceNow community post for IT operations teams puts the design in two lines: “ChatGPT decides which tool to call. ServiceNow controls what that tool can see and do.”
On October 29, Microsoft made the Dynamics 365 CX MCP Server for Sales generally available with 59 tools at launch. They cover opportunities, leads, quotes and orders, and they include tools that draft and send email and convert an approved quote into an order, along with opportunity tools that close deals. Clients discover the tool catalog when they connect, and access follows existing Dataverse roles and permissions. All three vendors keep execution inside their own systems and let the AI model choose from the tool catalog.
Each tool added to the catalog is an act of delegation
A workflow that runs the same steps every time is a strong control, and clients should want it. The automated steps, such as the eligibility check in the AWS refund example, are machine checking machine with no human review, which Puglisi classifies as Responsible AI. Two decisions stay outside the workflow definition. The agent still chooses when to start a refund and what amount and customer record to pass in, and someone at the client chose to put the refund workflow in the agent’s catalog in the first place.
That second decision often goes unrecorded. Redwood Software’s October 22 survey of 300 senior technology, risk and AI leaders found that 77% had experienced a negative consequence from an ungoverned AI agent, most often unexpected cloud costs, and only 42% kept a centralized registry of deployed agents. A company that cannot list its agents is unlikely to have a list of the tools each one can call. Redwood’s chief product officer, Charles Crouchman, said in the release that governance “can’t live in a policy document or wait for a post-incident review.” The tool catalog is where that enforcement starts, because it sets which actions an agent can attempt at all, and the permissions behind each tool still need testing.
How Puglisi would set up a client’s first agent tool catalog
The work starts with an inventory. For each workflow or tool the agent could reach, the team records whether it only reads data or can change or send something that cannot be pulled back, such as an email to a customer or a refund paid out. In Microsoft’s catalog, the send-email and close-deal tools sit next to read-only lookups, so a sales manager’s role may already allow both kinds.
Under his Checkpoint-Based Governance (CBG), a named owner then accepts, modifies or rejects each tool before it goes into the catalog, and that decision is logged with a date. Accepting can come with a modification, such as allowing the refund workflow only below a set amount. The workflow should enforce that limit itself, because a check coded into the workflow applies on every run, while a limit written only into the agent’s instructions depends on the model following it.
For every tool that can’t be undone, the workflow keeps a step where a person decides. In the AWS example, the manager approval step is the natural place for that decision. The client’s job is to confirm that a named manager makes that call on each agent-started refund, and that the step cannot be skipped when volume climbs.
Two numbers show whether the human step still works
GOPEL offers a way to measure whether that human step still works. The paper warns that the most common governance failure “is the human gradually stopping oversight without any single moment that triggers an alert,” and its reporting counts approval and reversal rates across human decision records. A client can apply the same idea to agent-started workflows. The first number is the reversal rate at the human step, the share of agent-started runs reaching that step that a manager modifies or rejects. A long stretch with zero reversals deserves a sample review of the underlying decisions, because it may mean the agent is excellent or that the manager has stopped reading.
The second number is catalog coverage, the share of enabled tools in the agent’s catalog that have a named owner and a dated approval decision. That figure should be 100% before any agent goes live with a tool.
The catalog will grow with every vendor release
ServiceNow says enhanced plugin capabilities are expected by the end of 2026, and Microsoft calls its general availability launch a foundational step toward headless CRM. Each release may put new actions within reach of an agent that a client approved months earlier for a narrower catalog. Clients running these integrations should schedule a catalog review for every vendor release, so a named owner approves each new action before an agent can use it.
Sources
- Amazon Web Services. (2026, October 29). AWS Step Functions workflows now available as AI agent tools. https://aws.amazon.com/about-aws/whats-new/2026/10/step-functions-workflows-ai-agent-tools/
- ServiceNow. (2026, October 28). ServiceNow and OpenAI accelerate enterprise AI, from models and operations to cybersecurity and agentic development [Press release]. https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-and-OpenAI-accelerate-enterprise-AI-from-models-and-operations-to-cybersecurity-and-agentic-development/
- OpenAI. (2026, October 28). OpenAI and ServiceNow expand partnership across enterprise workflows. https://openai.com/index/openai-servicenow-partnership-expansion/
- ServiceNow Community. (2026, October 28). ServiceNow is now in ChatGPT. Your ops context just went global. https://www.servicenow.com/community/itom-articles/itom-mcp-server-is-now-in-chatgpt-your-ops-context-just-went/ta-p/3615499
- Manchanda, T., & Darbarwar, R. (2026, October 29). Dynamics 365 CX MCP Server – Sales: Bringing headless CRM to supported AI experiences. Microsoft Dynamics 365 Blog. https://www.microsoft.com/en-us/dynamics-365/blog/it-professional/2026/10/29/dynamics-365-cx-mcp-server-sales/
- Redwood Software. (2026, October 22). 77% of enterprises have paid a price for ungoverned AI agents [Press release]. https://www.redwood.com/press-releases/ai-and-agentic-orchestration-benchmarks-report/
- Puglisi, B. C. (2026, March 8). GOPEL v1.5: The non-cognitive governance layer that automates without thinking. basilpuglisi.com. https://basilpuglisi.com/gopel-v1-5-the-non-cognitive-governance-layer-that-automates-without-thinking/
Questions readers ask
What did AWS announce for Step Functions and AI agents?
On October 29, 2026, AWS made Step Functions workflows available as tools for AI agents through Amazon Bedrock AgentCore Gateway. The agent decides when to run a workflow and what input to pass, and Step Functions runs each defined step, such as an eligibility check and a manager approval, in the same order every time.
What does the ServiceNow plugin for ChatGPT do?
The plugin, launched October 28, 2026, connects ChatGPT to a customer’s own ServiceNow instance so teams can find similar incidents, assess change risk and update records from a ChatGPT conversation. Customers choose which capabilities to turn on, and ServiceNow’s existing business rules and permissions apply to each action.
What is an agent tool catalog?
It is the list of workflows and actions an AI agent can call through a connection such as an MCP server. Microsoft’s Dynamics 365 CX MCP Server for Sales, for example, launched with 59 tools that agents discover when they connect.
Who should approve the tools an AI agent can use?
A named owner should accept, modify or reject each tool before it is added to an agent’s catalog, with the decision logged and dated. Under Checkpoint-Based Governance, that decision belongs to a person and comes before the agent runs, and tools that can’t be undone keep a human approval step inside the workflow.
How can a company tell if human approval of agent-started work is still meaningful?
Track the reversal rate at the human step, meaning the share of agent-started runs a reviewer modifies or rejects, and sample the decisions behind long stretches with no reversals. Also track catalog coverage, the share of enabled tools with a named owner and a dated approval, which should be 100% before go-live.
#AIg
Leave a Reply