Workday's autonomous AI agents raise questions nobody has answered yet

Autopilots in the back office

Workday announced this week that it is bringing autonomous AI agents to its finance and HR platform ^[1]. The agents will do things like flag discrepancies in invoices, suggest budget reallocations and recommend candidates for a role. Some will act without stopping to ask, once a customer has set what Workday calls guardrails.

It sounds efficient. It also raises a question that nobody in the announcement seems to have thought about: when an agent changes a budget line or puts a candidate on a shortlist, who keeps the record of what it did, and can you trust that record if it's questioned half a year later?

Think of it like the black box in a plane. When something goes wrong, investigators want to know what the autopilot did and what the pilots saw. If the box belonged to the airline and the airline could edit it, the findings would be harder to trust. The same goes for an AI agent's log.

What Workday is promising

The agents are part of what Workday calls Illuminate, a suite of AI tools ^[1]. According to the company, customers will be able to set controls that define when an agent can act on its own and when it has to wait for a human. Workday says the agents will work across finance, HR, planning and procurement, and that they will learn from data in the customer's own Workday environment.

The pitch is that finance teams will spend less time chasing invoices and HR teams will get better at spotting the right candidates. Workday's chief product officer told HR Dive that the agents are designed to take on 'lower-value tasks' so people can focus on decisions that need judgement ^[1].

That division sounds neat, but it assumes the agents will always stay on their side of the line. History suggests they won't.

What the AI Act will require

Under the AI Act, systems used in recruitment and workforce management count as high-risk when they are used to make or support decisions about hiring, promotion, task allocation or monitoring ^[2]. High-risk systems must log events automatically, under Article 12, so that what happened can be traced later ^[3].

For systems covered by Annex III, including recruitment and workforce management, the high-risk requirements apply from 2 December 2027 ^[2]. Article 12 says the logs must be kept for at least six months, under Articles 19 and 26 ^[4].

The law says what to log. It doesn't say how to protect the logs, or how to show that they haven't been quietly edited after a decision is questioned. That gap matters, because a log the operator can change is easy to challenge when someone asks what the AI actually did.

The questions customers should ask

When Workday talks about customer-defined controls, it isn't clear what that means in practice. Can a customer see a log of every action an agent took, with the instruction that triggered it? Can they export that log? And if an applicant or an employee disputes a decision six months later, can the customer show that the log is exactly what was written on the day?

Those questions matter in recruitment, where decisions about people have to be explainable and are often challenged. They also matter in finance, where an agent that moves budget or flags an invoice for payment is creating records that auditors and supervisors will want to trust.

The AI Act requires users of high-risk systems to monitor the operation and keep the logs ^[5]. It doesn't require them to seal the logs, but it's worth asking how a user shows that a log hasn't changed when the user is the one keeping it.

How an autonomous agent should keep receipts

When an agent acts without asking first, the thing to seal is the instruction it received, each tool it called and the result it got back. That record is sealed as the agent acts, not at the end of the day.

Sealing takes a fingerprint of the record, not the record itself, so the action log never leaves the customer's systems. The fingerprint goes to WitniumChain, which returns a witness ID. To check the record later, anyone the customer shares it with calculates the fingerprint again and compares it with the sealed one. Change a single character in the record and the fingerprints won't match.

That gives the customer a neutral record of what the agent did. It doesn't authorise the action, and it doesn't make the action correct or fair. What it does is take the question of whether the log has been edited off the table, because a change would show even if it were made by someone with administrator rights.

The mechanism works through the REST API, the SDK or the MCP server, and the first 2,000 witnesses a month are free. Instructions, tool calls and results can be sealed individually or in batches, depending on the volume. Full instructions are in the documentation.

How it would work

1. The agent receives an instruction, calls a tool and records the result.
2. A fingerprint of that record is sent to WitniumChain, which seals it and returns a witness ID.
3. Later, when the action is questioned, the customer calculates the fingerprint again and checks it against the sealed one.

What this means for you

If you're considering Workday's autonomous agents, or any other AI that will act without asking, here are the questions to ask now:

• Will the system log every action the agent takes, with the instruction that triggered it?
• Can you export those logs, and can you control where they are kept?
• If an action is disputed six months later, can you show that the log is exactly what was written on the day, without asking anyone to trust you?
• Who at your organisation has tested that the logs actually capture what you need them to, and that they can be checked by someone outside?

Autonomous agents will do useful things. They will also do things you didn't expect, and some of those things will be questioned. The time to decide who keeps the record, and how you prove it hasn't changed, is before the agent goes live.

What to watch

The AI Act's high-risk requirements for recruitment and workforce management AI apply from 2 December 2027 ^[2]. That gives organisations just over a year to work out how they will log what their AI does, and how they will show that the logs can be trusted.

Workday has not said when the autonomous agents will be generally available, or what logging and auditability features will be included. Customers who are testing the agents now should be asking those questions.

Meanwhile, the AI Office is working on guidance for Article 12 and the other high-risk requirements. That guidance will clarify what counts as adequate logging, but it won't tell you how to protect the logs or prove they haven't changed. Those are decisions every organisation using autonomous AI will have to make for itself.