Let AI watch the recruiting queue. Keep intervention authority explicit.

A recruiting queue is operational data about people

Workday's October 13 announcement makes a specific pattern visible. Its early-access Talent Acquisition Agent watches open roles, flags healthy and at-risk pipelines, surfaces candidate qualifications and gaps, proposes sourcing actions, drafts outreach, coordinates interviews, and stores recruiter preferences. Workday states that outreach still requires recruiter approval before it is sent. That is a useful boundary, but it is only one boundary.

An agent can reach a draft-outreach gate after already making consequential choices: which requisition is “at risk,” which sources to search, which people to surface, which evidence counts as a qualification, which gap is worth mentioning, and whose profile receives recruiter attention. A human approving the final message does not automatically review those upstream decisions.

The operating model therefore needs to separate queue monitoring from candidate assessment. “This requisition has received no completed applications in seven days” is a deterministic process signal. “These five people are qualified” is an assessment that depends on criteria, evidence, data rights, model behavior, and employment law. “Send this person a message” adds identity, consent, channel, duplication, accuracy, accessibility, and reputational risk.

Current community evidence reinforces the need for restraint. Workday Candidate Profile drew strong positive reaction because candidates are tired of repeated accounts and re-entered histories, but the same discussions include skepticism about data reuse and monetization. Workday explicitly says Candidate Profile only fills information job seekers choose to save and does not rank, recommend, or reject anyone. Keep that distinction visible: data portability and candidate assessment are different product functions and require different controls.

requisition baseline -> queue trigger -> source reconciliation
        -> candidate-impact classification
        -> evidence record + legal/accessibility checks
        -> bounded action options + exact draft
        -> named-human approval
        -> approved-system execution receipt
        -> candidate/process outcome verification
        -> monitoring, correction, and recalibration

Classify the action before reviewing the output

This classification prevents authority from expanding by convenience. An agent allowed to remind an interviewer is not therefore allowed to infer that missing feedback means a weak candidate. A system allowed to draft outreach is not therefore allowed to select recipients from an unapproved data broker. A system that summarizes candidate-supplied facts is not therefore allowed to create a composite score.

Memory needs the same treatment. Workday describes saving recruiter preferences such as interview timing or format. Preferences can improve coordination, but they can also preserve a temporary exception, personal habit, or inaccessible default. Store preference owner, scope, source, effective date, expiry, and override history. Never let individual preference memory alter approved job criteria or candidate assessment.

Freeze a versioned intervention contract

The contract is the review object connecting the signal to the action. It should be readable by recruiting, HRIS, legal, privacy, accessibility, and analytics owners without requiring them to reverse-engineer a model prompt.

intervention_id: TA-2026-1042
requisition:
  id: REQ-8841
  version: 7
  owner: recruiter-142
  approved_criteria_hash: 51f3...ca90
trigger:
  type: thin_pipeline
  formula: completed_applications_last_7d < 5
  observed: 3
  data_cutoff: 2026-10-16T08:00:00Z
population:
  eligible_candidates: 3
  missing_or_errored: 0
action:
  class: candidate_communication
  proposal: draft_outreach_for_review
  recipients: [candidate-771]
  channel: approved_email
  duplicate_check: pass
review:
  recruiter: required
  employment_counsel: not_required_per_policy_HR-42_v5
  accessibility_path: included
execution:
  system: workday-recruiting
  payload_hash: a6d2...f081
verification:
  expected: one_message_recorded_and_delivered
  correction_owner: ta-ops-oncall

Do not allow the model to write its own threshold and then declare the threshold met. The employer supplies the trigger definition, minimum sample, baseline, cooldown, and owner. The system calculates the signal from reconciled source records and reports false, confirmed, inconclusive, or blocked. A “thin pipeline” alert may be false because a role is paused, event ingestion is delayed, applications are incomplete, a location changed, or the target date was extended.

Criteria changes belong in a different workflow. If the agent concludes that the pipeline is thin because compensation, location, or requirements are unattractive, it may present the evidence and ask for review. It must not quietly loosen minimum qualifications or broaden a location filter. A revised requisition needs a new version, owner approval, candidate-impact analysis, communication plan, and decision about people previously excluded.

Build candidate evidence records, not model biographies

A candidate evidence record links each qualification statement to an authorized source. Good evidence might include a candidate's submitted application, resume, assessment response, or recruiter-verified correction. A model-generated summary is not a new fact. If the source says “managed a team of four,” the record may quote and map that statement to an approved criterion. It may not upgrade it to “proven enterprise leadership.”

Missing information must remain missing. It should not become a negative score, a guessed value, or an inferred lack of interest. This matters when application systems have friction: a missing field may reflect an inaccessible form, a save failure, mobile limitations, an integration defect, or a candidate choosing not to disclose unnecessary information.

The focused research surfaced a public Workday-form automation issue with concrete failures: employment dates left empty and an education card referring to a block the automation did not read. That project is not Workday's recruiting agent, and its issue is not product evidence. It is still a useful failure fixture: automation can complete most of a form, produce a plausible summary, and miss a field that changes interpretation. Test partial reads, stale page state, repeated blocks, hidden validation, and contradictory fields.

Do not collapse sourcing, assessment, and legal scope

Employment counsel should classify the actual use, jurisdiction, and facts. In New York City, Local Law 144 requirements apply when an automated employment decision tool substantially assists assessment or screening for hiring or promotion. The city's FAQ distinguishes resume-bank scanning, outreach, or invitation before a person applies from covered assessment of a candidate for a specific position. That distinction is useful, but it is not permission to hide assessment inside “sourcing.” If the tool evaluates people or its output substantially assists who advances, route it through the appropriate audit, notice, and governance process.

Federal anti-discrimination duties do not disappear because a vendor supplies the model. EEOC materials state that existing protections apply when AI is used in job search, recruiting, screening, or hiring, and that accommodation duties can still apply. Preserve a visible accommodation route in application, outreach, scheduling, assessment, and interview flows. Do not infer disability or accommodation need from behavior.

NIST's AI Risk Management Framework is voluntary, but its operating ideas are practical here: define human-AI roles, document responsibility, measure system behavior, manage risk throughout the lifecycle, and maintain leadership accountability. A vendor statement that an agent “inherits policies” does not prove that the employer configured the correct policy, that connected providers obey it, or that logs are complete.

Keep data authority explicit across Workday Recruiting, HiredScore, Paradox, sourcing providers, Slack, email, calendars, and interview tools. A legitimate integration is not blanket permission to combine every field. Minimize data, state the purpose, bind service identities, restrict retention, and preserve who saw or changed what.

Worked example: a thin pipeline without automatic outreach

A recruiter owns a software-support requisition with a target fill date in 30 days. The configured rule expects at least five completed applications that satisfy the employer's approved minimum criteria within seven days. The agent sees three and raises a thin-pipeline alert.

1. Validate the signal. Recruiting operations confirms the requisition is open, the application feed is current, no completed application is missing, and the role was not paused. The trigger is confirmed.
2. Review the baseline. The hiring manager confirms that the approved minimum criteria are still job-related. Compensation and location facts match the posting. No criterion changes are authorized.
3. Build evidence. The agent identifies one prior applicant who opted into future opportunities and whose submitted record contains evidence for the minimum criteria. It labels one preferred qualification as missing rather than failing.
4. Check authority. The source register permits reuse for this purpose, the retention period is valid, the person has not opted out, and no recruiter or agency has contacted them inside the cooldown.
5. Draft only. The agent prepares an email using approved role facts and a visible accommodation route. It cites the prior application as the factual basis and does not claim the person is a “top match.”
6. Human release. The recruiter reviews the candidate record, recipient, message, compensation/location facts, contact history, and channel before approval.
7. Verify. The system records one send, receives a delivery status, and exposes opt-out. If the message fails, it does not automatically switch to another channel.

If the recruiter decides the person should not be contacted, record the reason without altering the candidate record. If the trigger repeatedly fires because the job requirements are unrealistic, route a requisition-design review. The agent's queue objective must not pressure reviewers to lower standards, over-contact candidates, or bypass accommodation and notice controls.

Failure modes to test before expanding authority

Pilot detection and draft-only actions first

Start with a small set of approved requisitions, named recruiters, and low-impact triggers. Keep all candidate contact and assessment behind a human gate. Use a comparison period or matched workflow where possible, but do not infer causation from a short before-and-after dashboard.

• Trigger quality: confirmed, false, missed, inconclusive, and blocked alerts by trigger and requisition type.
• Evidence quality: unsupported claims, missing citations, contradictions, stale records, and reviewer corrections.
• Human review: approval rate, edit rate, override reasons, review time, and separation-of-duty exceptions.
• Candidate contact: duplicate messages, wrong recipient, opt-outs, delivery failures, complaints, and corrections.
• Accessibility and accommodation: requests, failed routes, response time, and resolution without inferring protected status.
• Fairness: lawful outcome and error analysis across relevant groups, stages, sources, locations, and job families.
• Operations: verified time-to-action, scheduling failures, unresolved exceptions, and queue aging.
• Security and privacy: unauthorized access, data over-collection, provider drift, retention exceptions, and incident response.

Define stop conditions before launch: material disparity, repeated unsupported qualification claims, missing notices, accommodation failure, unauthorized source use, duplicate outreach, unexplained population gaps, or inability to reconstruct a decision. The right response to a bad pilot is not a better prompt. It may be a narrower task, a deterministic rule, a corrected data process, or removing the agent from that action.

FAQ

Can an AI recruiting agent contact candidates automatically?

Only if the employer has explicitly authorized the exact action, channel, data, criteria, and review model. Workday's current announcement says drafted outreach requires recruiter approval before sending. This guide recommends keeping candidate contact behind a named human gate during rollout.

Is monitoring requisition health a candidate decision?

Not by itself. A count of completed applications or an overdue interview step is a process signal. The system crosses into candidate assessment when it evaluates, scores, ranks, recommends, or materially influences who advances.

Does NYC Local Law 144 cover sourcing outreach?

The city's FAQ says resume-bank scanning, outreach, or invitation before a person applies is not itself covered candidate assessment under that law. Facts and implementations vary. If the tool assesses or screens an applicant for a specific role, or its output substantially assists the decision, obtain qualified legal review and apply required controls.

What should recruiters approve?

They should approve the exact recipient population, evidence, role facts, message, channel, timing, duplication check, accessibility path, and expected outcome. A generic “allow outreach” setting is too broad.

How does this relate to Workday Candidate Profile?

Candidate Profile is a separate announced feature expected in early 2027. Workday says it reuses candidate-chosen application information and does not rank, recommend, or reject people. Treat data reuse and candidate assessment as distinct controls.