Watch on YouTube · subscribe for the daily brief

“You can copy the data anywhere. The rules stay home.”

Workday just argued that the data lake is the wrong place to point your AI agents, and it brought a demo with a salary in it.

At its Rising conference on Tuesday, Workday made its Trusted Agent Platform headless. Outside agents can now read and write HR and finance data without anyone logging into Workday’s screens. The key pieces are generally available. There’s an MCP server called Agent-Ready Tools, with two hundred seventy-five read tools and fifty-four that write or delete data. There’s a SQL interface called Live Data Query that runs against live Workday data. And there’s an agent runtime. Developers can build in Claude Code, Cursor or Codex, and each agent is limited to what the signed-in user can already see.

The interesting part is the argument. Many companies today point agents at a copy of HR data in a lake, or connect through a service account. Workday says both bypass its access controls. As one Workday executive put it, you can export your data, but you can’t export the rules that govern it. In a demo, an agent connected to a Snowflake copy of Workday data returned the CTO’s salary without authorization. Routed through Workday’s own tools, it returned only what the user was allowed to see.

Now the skepticism. Workday has every reason to want your agents coming through Workday instead of your warehouse. Snowflake, Databricks and SAP would all argue their own access controls hold up. And Workday’s own zero-copy integrations with Snowflake and Databricks went live around the same time. A salary leak from a lake copy is a governance failure in that copy. It isn’t proof that lakes can’t be governed.

But the uncomfortable point survives the sales pitch. When you copy data into a lake, you copy the rows. You don’t automatically copy the row-level rules, the approvals, or who’s allowed to see what. Data teams have rebuilt those rules by hand for years, and they drift. That was survivable when the reader was a dashboard and a person. It’s riskier when the reader is an agent that will happily answer any question it’s asked.

It’s a lesson we’ve hit twice already this month, from different sides. Permissions belong in something you can review and enforce, not in a prompt. And a metric means nothing without its definition. Access rules are the same kind of context, and they don’t travel with the rows.

Workday wasn’t alone. Shopify opened its catalog to more AI agents. Workday also partnered with Anthropic to put its Sana agents inside Claude, with Workday’s permissions applied to every request. Disclosure: these briefs are drafted with Claude. And Workday agreed to buy C1.ai, an identity governance company, to govern what agents can reach.

The New Stack named the gap that’s left. The agent did the work, and the audit log couldn’t say who asked. When an agent acts on payroll, someone will ask who authorized it.

So what do you do? Find every place an agent reads sensitive data from a copy. For each one, ask whether the copy carries the source system’s access rules, or a hand-built approximation. If it’s an approximation, either route the agent through the source system’s governed interface, or make the copy’s rules something you test, not something you hope.

Builder’s bench

• Gemini 4 Argon finally reached paying users, in the Gemini app for Pro and Ultra subscribers and in Antigravity, with a unified one million token limit for input and output. The frontier we couldn’t have two weeks ago now has a price tag.
• Anthropic says it cut theft of Claude’s reasoning tokens by up to ninety-nine percent in its fight against distillation. Its red team also ran AI on fifteen cheap TV boxes, and a study warns small models could soon replicate across everyday devices.
• Four hundred six scientists demanded AI models be cut off from the internet immediately. Machine learning pioneer Michael I. Jordan called AI doom rhetoric a grand moralizing performance.
• Character.AI filed for bankruptcy, and Disney offered twenty million dollars for its chatbot tech. MIT Technology Review reports AI labs are buying data from dead startups to train their models.
• SpaceXSI now bundles X Premium, Grok and Cursor into one subscription, and Claude now costs extra inside it. Workday is also using TypeSafe’s Jev to build user interfaces on the fly.
• Google wants to host your personal vibe-coded apps in the Play Store. Pluto Security raised forty-two million dollars. An OpenAI engineer was arrested for allegedly planting a spy device in the office, and a judge ordered OpenAI to turn over hiring records in Apple’s trade secrets case.
• Also worth a read: ClickHouse chasing a thirty-two millisecond tail latency, Simon Willison on how Anthropic redesigned source control, and Ben Lorica on the local AI question he had backwards.

The through-line: you can copy the data anywhere, but the rules stay home, so give agents a path that carries both.

One thing to do today: list every agent or AI feature that reads HR, finance or customer data from a copy. Next to each, write where its access rules come from. Any row that says “we rebuilt them” goes to the top of your review.

Sources covered

1 story · 59 sources (48 news, 6 company, 5 voices)

1. Redesigning source control at Anthropic
   🎙️Simon Willison↗🎙️Simon Willison↗📰SiliconANGLE↗📰BleepingComputer↗📰SiliconANGLE↗📰BleepingComputer↗📰TechCrunch↗📰The Verge↗📰SiliconANGLE↗📰The Decoder↗📰TechCrunch↗📰Ars Technica↗📰TechCrunch↗📰The Decoder↗📰The Verge↗🎙️Simon Willison↗📰TechCrunch↗📰TechCrunch↗📰The Decoder↗📰The Verge↗📰Ars Technica↗🎙️Ben Lorica↗📰The Verge↗📰TechCrunch↗📰The Verge↗📰The New Stack↗📰TechCrunch↗📰SiliconANGLE↗📰Ars Technica↗📰The Verge↗📰The New Stack↗🏢IBM Research↗🏢LangChain↗📰The Decoder↗📰Ars Technica↗📰The Verge↗📰The New Stack↗📰SiliconANGLE↗📰The Decoder↗📰TechCrunch↗📰The Verge↗📰TechCrunch↗📰TechCrunch↗📰LWN.net↗📰The Verge↗📰The New Stack↗📰The New Stack↗🏢ClickHouse↗📰The New Stack↗🏢Starburst↗📰InfoQ↗📰The Decoder↗📰The Decoder↗📰The Verge↗📰MIT Technology Review↗🏢NVIDIA↗📰MIT Technology Review↗🏢Character.AI↗🎙️Simon Willison↗