Should You Let AI Agents Run Your HR and Finance Workflows?

Last Updated: 24 October 2026

Key takeaways

Workday and Google Cloud connected Sana Self-Service Agent to Gemini Enterprise in May 2026, with Gemini as the default model for Sana for Workday across HR and finance workflows.

The architectural centre is Workday's Agent System of Record, which anchors agent permissions, business rules, approval chains and audit to the system of record rather than to the model.

These agents do not just answer questions. They submit leave requests, bulk approve timesheets, start performance reviews and submit payroll input.

Most failures will be process failures, not model failures. A correct action by an unauthorised agent costs more than a wrong answer.

The right sequence is map the process, clean the data, define the approval chain, then switch the agent on. Not the reverse.

What did Workday and Google Cloud actually ship?

On 28 May 2026, Workday and Google Cloud announced an expanded partnership that brings Workday's Sana Self-Service Agent into Gemini Enterprise, with Gemini becoming the default AI model for Sana for Workday. Early access went to eligible Workday customers. The interesting part is not the model choice. It is where the agent is allowed to act.

According to Devlery's analysis of the announcement, employees can check time-off balances, view payslips, review tax withholding, update personal information and create leave requests from inside Gemini Enterprise. Managers can review team goals, bulk approve timesheets, start performance reviews and submit payroll input. Finance users can ask about expense and travel policy, check corporate card eligibility and create requests or cases.

Read that list again and notice the mix. Checking a balance is a read. Updating personal information is a write. Bulk approving timesheets changes pay and attendance records for other people. Submitting payroll input creates finance and compliance exposure. One conversational surface now spans all four risk levels.

Diagram of the Workday agent stack from Gemini Enterprise conversation to Sana to ASOR to HR actions — How it works: the conversation surface sits above Sana, and Workday's system of record enforces permissions and approval chains beneath it.

Why HR and finance agents are different

Customer support agents can afford to be wrong. They apologise and try again. Payroll agents cannot. A wrong answer in HR is annoying. A wrong action in HR is a compliance event, a pay dispute or a privacy breach. The asymmetry matters: an agent that submits payroll input incorrectly can affect every employee in a pay run, and the correction cost is measured in days, not clicks.

That is why Workday's announcement leads with governance rather than model capability. The Agent System of Record, or ASOR, makes Workday's user permissions, business-process framework, data model and approval chains the reference point for agent execution. The agent becomes an action layer on top of an existing system of record, not a new system that improvises policy after a model response.

According to Beri's analysis of Workday's agent business, agentic AI annual recurring revenue is approaching $500 million with 200% ACV growth, and finance leaders should expect agent licensing to appear as a separate line item in renewals. Vendors are monetising the action layer, which means buyers need to be precise about what actions they are buying.

Diagram triaging HR and finance process steps into automate, assist and human only lanes — How it works: each process step is classified by reversibility, then routed to automation, assisted review or a human-only lane.

Most agent failures are process failures

In our consulting work, the pattern is consistent. A business buys an agent platform, points it at a messy process, and blames the model when the output is wrong. The model was rarely the problem. The process had three approval paths, two spreadsheets acting as shadow systems, and a policy that lived in someone's head.

An agent amplifies whatever structure it finds. If the process is clean and the rules are explicit, the agent executes quickly and predictably. If the process is ambiguous, the agent makes ambiguity visible at machine speed, which looks like chaos but is really a diagnosis. That is useful if you treat it as one.

Process state	What the agent does	Business outcome	Fix before scaling
Documented, single approval path	Executes within policy	Faster cycle time	None, scale it
Documented, multiple exceptions	Handles the common path, escalates the rest	Partial automation	Consolidate exception rules
Undocumented, tribal knowledge	Invents a plausible path	Risk and rework	Map and document first
Conflicting systems of record	Picks one and creates drift	Data integrity failure	Resolve the source of truth

How to triage which steps an agent should touch

Sort every step in the workflow by two questions. Can it be reversed? Does it affect another person's pay, record or legal position? Reversible and low-impact steps are safe to automate. Reversible but high-impact steps should be agent-prepared and human-approved. Irreversible steps stay behind a hard gate, with the approval cryptographically tied to the exact payload.

The frequency dimension matters too. A high-frequency, low-risk step is where automation pays back fastest. A low-frequency, high-risk step is where automation creates the most damage for the least benefit. Put those in different lanes and stop arguing about whether "the agent is ready".

Quadrant infographic plotting HR and finance agent workflows by frequency and risk — At a glance: frequency and risk decide whether a workflow should be automated, assisted or left alone.

Designing the approval chain

A workable approval chain has four parts. The agent proposes an action with the exact payload. The system checks policy and authority before a human sees it, so managers are not asked to approve things that are already invalid. The approver sees a diff, not a paragraph. The approval is bound to the payload hash, so any change after approval voids it and forces a re-approval.

This is also where audit lives. Every proposal, policy check, approval and execution writes to an immutable log with a single correlation ID. When a payroll error surfaces three weeks later, you can reconstruct exactly which agent proposed what, which rule passed it, and who approved it.

Diagram of an HR agent approval chain from proposal through policy check to payroll commit and audit — How it works: policy is checked before human review, and approval is bound to the payload so late changes cannot slip through.

Data boundaries and zero-copy access

HR and finance data is among the most sensitive in any business. The safe pattern is zero-copy access: the agent queries the system of record through governed APIs and never copies employee records into a separate vector store or prompt cache. Retrieval happens inside the permission model, and the agent sees only the fields its scope allows.

Workday's announcement names A2A, A2UI and MCP as the protocols for agent handoff and UI interaction, which signals where enterprise agent design is heading. The important detail is that permissions stay attached to the system of record, not to whichever agent happens to be orchestrating the task.

Diagram of zero-copy HR data access where the agent queries the system of record inside the permission model — How it works: the agent reads through governed APIs inside the permission model, so employee data is never copied into a separate store.

What Australian employers need to watch

Australian payroll and HR sit inside a dense compliance frame: the Fair Work Act, modern awards, superannuation guarantee, single touch payroll reporting and the Privacy Act 1988. An agent that bulk approves timesheets or submits payroll input is making decisions with legal consequences, and the business remains accountable for them. Agent errors are not a defence.

Two practical rules follow. First, keep a human accountable for any action that changes pay or an employee record, even when the agent prepares it. Second, retain agent decision logs for at least the period your payroll and privacy obligations require, in a store the agent cannot edit. If you operate across states, check award interpretation separately, because an agent trained on a national policy will misapply state-specific rules.

Frequently asked questions

Should I let AI agents run HR and finance workflows?

Yes, for bounded, reversible steps with a clear policy. No, for irreversible actions such as payroll submission or bulk timesheet approval, unless a human approval gate is bound to the exact payload. The decision should be made per process step, not per platform.

What is Workday's Agent System of Record?

It is Workday's framework for making its user permissions, business rules, approval chains and audit the reference point for agent execution. In practice it means the agent acts inside the system of record's policy model rather than improvising permissions after a model response.

Why do HR agent projects fail?

Usually because the underlying process is ambiguous or undocumented. The agent then invents a plausible path, which produces inconsistent actions and rework. Mapping and cleaning the process before switching the agent on prevents most failures.

Do AI agents replace HR staff?

They remove the repetitive preparation and lookup work: policy questions, leave balances, timesheet collation, expense eligibility. Judgement, exception handling and accountability stay with people, and the approval chain is where that accountability is recorded.

How should we audit HR agent actions?

Log the proposal, the policy evaluation, the approver identity and the executed payload under one correlation ID, in an append-only store the agent cannot modify. Retain those logs for the period your payroll and privacy obligations require.