Home
Blog
AI Agents & Orchestration
A Webinar Recap
Hannah Peacock
Director, Solutions Marketing
Nov 9, 2026
Ask a CISO what keeps them up at night with AI agents, and you’ll hear about control. Ask a CIO, and you’ll hear about results.
On October 15, Workato CISO Hans Gustavson and CIO Carter Busse sat down with Carly Urmann, Director of Product and Growth Strategy, to argue that those are the same problem.
The stakes are personal. In a recent Workato and Censuswide survey of 1,000+ enterprise IT leaders, 74% said they’d be held accountable if an agent went rogue, no matter who built it.
Everyone has a policy. Almost no one has enforcement.
EY found that 98% of large U.S. enterprises have a formal AI governance policy, and 47% admit they’ve skipped it for an urgent deployment.
When presented with these numbers, Hans wasn’t surprised. At Workato, AI adoption initially outran the company’s ability to see it. Procurement and change-management reviews caught some of it, but blind spots remained. Then citizen developers started building agents and vibe-coded apps with no concept of a software development lifecycle.
“Enforcement means a control holds up, even if it isn’t followed perfectly, and we have evidence to show it.” – Hans Gustavson, CISO, Workato
A rule against sending customer data to unapproved models is just intent. It becomes enforcement when the system blocks the action itself.
Five questions that size up any agent
Not every agent deserves the same scrutiny. Hans’s team sorts agents into risk tiers, then asks five questions every time:
- What can it touch? Tools, connectors, MCP servers, and anything destructive or irreversible.
- What data can it reach? And how sensitive is it?
- How is it limited? Who can actually use it?
- What did it actually do?
- Can I prove it to an auditor?
Tiers set the level of human oversight. Workato’s security operations agents triage thousands of signals, and a playbook pulls in a human only where consequences are high, which Hans put at roughly 20-30% of events. An internal Q&A agent tied to a knowledge base runs with no human in the loop.
The rule: humans show up where the consequence is.
The door is guarded. The building isn’t.
Gateways and proxies get the attention, and Hans was blunt about where they stop. They were designed around a person at a keyboard. Agents run headless in the cloud, call APIs directly, and connect through OAuth grants and MCP servers, often never touching a managed endpoint.
A gateway can authenticate an agent at the door. Downstream, it’s frequently a shared service account, so the trail ends at an account instead of a person. Traffic, credentials and catalogs sit in separate tools with separate owners, and none of them sees what the whole business process did with the result.
For third-party MCP servers, Hans’s advice is practical: “you can’t read a vendor’s code, but you can test how it behaves.”
- Check for real user identity through single sign-on.
- Test permissions tool by tool.
- Send unauthorized requests and confirm they fail.
- Make sure logs show who, which agent, which tool and what happened.
The testing had a side benefit. Many vendor servers expose far more than anyone needs, making them slow and expensive. In some cases, Workato built smaller, narrower versions that cost less and gave auditors less to chase.
Governed access still doesn’t finish the job
Suppose security gets all of that right. Are we done?
Carly put the question to Carter with another data point: in CIO.com’s State of the CIO survey, only 19% of respondents said their AI initiatives had met or exceeded business goals.
Carter’s answer: governing access only tells you an agent can call a tool. It says nothing about whether the job finished correctly.
His example is a sales rep who asks, in plain language, for a quote. The agent reads the opportunity, call recordings and notes, builds the quote, creates it in Salesforce as that rep, and routes it for approval.
To the rep, it’s one conversation. Behind it are authentication, data validation, approvals, retries and exceptions across several systems.
The control plane also forces the question most AI projects skip. Every agent or MCP server must declare a business KPI before it goes to production. No metric, no launch.
“If there’s no metric tied to an agent, it’s still a demo.” – Carter Busse, CIO, Workato
Govern the environment, not every build
If every agent needs a review, nothing ships. Carter’s alternative: the central team sets the rules once, and business teams move fast inside them.
Workspaces are tiered by risk. Anything touching cash gets tight IT control. Marketing gets room to experiment.
One result: a marketing operations agent that watches 26 data signals, from job changes to pricing-page visits, and generates leads autonomously. Carter compared its output to roughly four and a half SDRs.
A unified control and execution platform
Hans and Carter kept returning to the same two-sided test:
“Control without execution gives you a well-governed agent that can’t finish the job. Execution without control gives you a capable agent you can’t trust.” – Hans Gustavson, CISO, Workato
So when you evaluate any platform, ask one question: does the same identity, policy and audit trail follow an action from design all the way to runtime? If the answer changes at the handoff, you don’t have governance. You have two systems and a gap.
Control without execution stalls. Execution without control is a risk. Watch the recording for the full conversation, then learn how Workato brings control and execution together for enterprise AI.
More on AI Agents & Orchestration
Discover the latest product updates and features
What Is an LLM Router?
Nov 5, 2026
Which Agentic Workflow Steps Should Be Deterministic?
Nov 5, 2026
Why Do AI Bills Rise When Token Prices Fall?
Nov 5, 2026
Table of Contents
