Ryan Johnson

Making AI agents less intimidating and more useful at work. Practical notes for L&D, HR, workforce learning, and enterprise teams. Building

[Ryan Johnson @RyanWorkforceAI]

Some of the best testing of your AI rules happens outside the security team. It happens when an employee rephrases a request and the agent does something it was supposed to refuse.

Fixed guardrails don't hold up against prompts that keep changing. A NIST result this year says no finite set of guardrails is universally robust against adversarial prompts. So your controls need a steady feed of fresh failures, and your people are already running into them.

Make it easy for them to tell you:

• a one-line way to report "the agent did something it shouldn't have"
• no blame for the person who found the gap, even if they were poking at it
• the exact wording that got through, saved with the date
• one named owner who reads those reports every week
• a reply to the reporter saying what changed, so they keep reporting
• a monthly count of reports, where a sudden drop to zero is a warning sign

The question is not whether your guardrails are good enough.
It is whether the people who watch them fail have somewhere to say so.

This week: ask three heavy users of your internal AI tools one question. "Have you ever gotten it to do something you thought it shouldn't?" Write down every yes. That list is your next round of fixes.

[Ryan Johnson @RyanWorkforceAI]

@BryanTGrime_ Thanks to the reply! It would be nice if enterprises could figure out a clean dashboard view for this without having to be an IT SME... if we will all soon become managers of agents, we need a better visibility to ensure governance and security!

[Ryan Johnson @RyanWorkforceAI]

Your AI agent can follow a request perfectly and still break policy, because the one fact that mattered was never in front of it.

Example from a 2026 research paper: someone asks an assistant to share the onboarding folder with a new hire. It shares all three files. One was an HR-only headcount sheet that HR had temporarily parked there. Nobody was attacking anything. The request was fine. But the agent couldn't see the label.

In that benchmark, five frontier models carried out the violating action in 90 to 98% of the risky cases. Adding the policy rules to the prompt helped, but about 4 in 10 risky cases still ended in a violation.

Where to look in your own workflows:

• folders where restricted files get staged "just for now"
• contact lists that still include people who left or contracts that ended
• sessions where the agent reads something internal, then drafts something external
• bulk actions (share all, forward all, delete all) with no per-item check
• rules that live in a policy PDF but not in the system the agent actually touches

Stop asking whether the agent understood the policy.
Ask whether the facts it needed were visible when it acted.

Today: pick one agent that can share, send, or delete. Write down the three things a careful person would check before doing that. If the agent can't see them, put the check outside the model (a label, a lookup, an approval step) before you give it more reach.

[Ryan Johnson @RyanWorkforceAI]

If an AI agent can finish your compliance course for an employee, look at the course before you look at the employee.

Static slide decks with a multiple-choice quiz at the end are exactly the kind of training agents breeze through, and if people would rather hand it to a bot, that tells you something about the content.

Before you go hunting for who used an agent, look at what the course actually asks people to do:

• a quiz that asks what slide 6 said, when the job needs a decision
• no scenario where the right answer depends on the situation
• nothing that needs a live person (role-play, a manager watching, a peer pushing back)
• one check on the day they finish, and none weeks later
• no tie between the module and anything the team already measures
• content nobody has updated since it went live

Banning agents won't fix this. They'll just keep clicking, and the completion report will keep looking great.

A course an agent can finish proves the course can be finished.
A course where someone has to make a call in front of another person shows whether they learned it.

This week: open your most-assigned compliance module. Rewrite the last quiz question as a short scenario from your own workplace, where the answer depends on what's going on. If an agent could still answer it from the slides alone, rewrite it again.

[Ryan Johnson @RyanWorkforceAI]

Your org chart lists every person on the team. It doesn't list the agents that may now draft offer replies, route HR cases, and start approvals.

That gap is real. Most enterprise HR systems weren't built to store, manage, or audit work done by non-human workers. So the agents end up living in IT tickets, vendor dashboards, and one engineer's head.

Before the next audit or reorg asks "who did this?", start a plain roster:

• every agent touching a people process, with a one-line job description
• the human who owns it (a name, not a team alias)
• which systems it can read and which it can change
• where it hands off to a person, and where it doesn't
• the date someone last checked it still does what the roster says
• what happens to it when its owner changes roles

You don't need a new platform for this. A shared spreadsheet with an owner column beats a clean HR system that can't see the agents at all.

The question is not "are our agents working?"
It is "could we show, from our own records, what an agent did to an employee's file last month?"

Monday: pick one people process (onboarding, scheduling, case intake). List every agent that touches it. If one has no named owner, that's your first fix.

[Ryan Johnson @RyanWorkforceAI]

When someone leaves your team, you revoke their badge and laptop. Their AI agents often keep running with the same reach.

That is agent access drift. The permissions outlast the person, the project, or the task that justified them. Quiet expansion. Quiet persistence. Quiet reuse.

Before your next offboarding or reorg lands, watch for:

• agents still tied to an owner who left or changed roles
• credentials issued for a pilot that never got a close-out review
• an agent moved to a new workflow that kept the old system reach
• no calendar date for when agent permissions get rechecked
• no named person who can kill access tonight
• dashboards that track agent uptime but not who still owns the keys

The question is not whether you provisioned carefully at launch.
It is whether access dies when the human context that justified it dies.

Monday: pick one agent whose owner changed in the last 90 days. If you would not grant that same access today for what it is doing now, revoke or rewrite it before noon.

[Ryan Johnson @RyanWorkforceAI]

Your AI rules got locked last quarter. Filters on. Blocked-prompt list filed. Then someone rewrites the ask on Tuesday, and the fixed list does not move.

A one-time guardrail set will not hold against prompts that adapt. Treat the controls like work you keep doing:

• log which prompts get refused, and which ones get through after a rewrite
• re-test the same high-risk asks every week with fresh wording
• give one person ownership of updating the block list when a new bypass shows up
• separate "policy published" from "policy still works"
• keep a short path for a human to escalate when the agent does something the rule missed
• do not assume last month's safe setup is still safe this month

The question is not whether you have guardrails.
It is whether anyone is watching them fail and updating them when they do.

Monday: pick one high-risk agent workflow. Ask someone outside the build team to try three fresh prompt variants that should be blocked. If any get through, fix the control before you ship the next feature.

[Ryan Johnson @RyanWorkforceAI]

Your LMS just closed another clean completion week. The green bars look fine. The catch is that some of those modules may have been finished by an agent in the employee's browser, not by the person who needs the skill.

When agents can click through training for people, completion stops meaning learning. Watch for:

• modules finished in minutes that used to take an hour
• perfect quiz scores with no wrong answers in the history
• the same session pattern finishing courses for many people
• managers who only ask "is it done" and never ask "can they do it"
• compliance dashboards that treat a green bar as proof of readiness
• no spot-check where someone has to show the skill on a live task

The question is not whether completion rates look healthy.
It is whether the person who got credit can still do the job without the agent.

Friday: pick one high-stakes module. Pull five recent completions. Ask each person to show you one step from that course on a real task. If they stall, fix the metric before you celebrate the dashboard.

[Ryan Johnson @RyanWorkforceAI]

Your agent's permissions often outlive the job you gave it.

Someone opened access for a pilot. The pilot ended. The credential stayed. Or the agent moved to a new workflow and kept the old reach. That is agent access drift: quiet expansion, persistence, or reuse of permissions after the task, owner, or business context changed.

Before you trust the next agent run, check:

• Who owns this agent today, by name
• What systems it can still touch
• Whether that list matches the current task
• When those permissions were last reviewed
• What happens when the owner leaves or the project ends
• Where you would kill or roll back access tonight

Initial provisioning is not the whole risk. Continuity is.

The question is not "Did we approve access at launch?"

It is "Would we approve this same access again for what the agent is doing now?"

Pick one agent this week. Re-approve or revoke what it can reach.

[Ryan Johnson @RyanWorkforceAI]

Most teams still install AI agents the way they install software. License, deploy, hope the defaults hold. That works for a plugin. It fails for something that acts under your name.

Before the next agent goes live, give it the same setup a new hire gets:

• a named role with a clear scope of work
• its own credentials, not a shared service account
• a human manager who owns what it can and cannot do
• written guidelines for when it must stop and escalate
• a review date on the calendar, not "we'll check later"
• an offboarding path that kills access the day the job ends

The question is not whether the agent can finish the task.
It is whether anyone can say who owns it, what it is allowed to touch, and who shuts it down.

Tuesday check: pick one agent already in production. Write its role, owner, credentials, and kill path on one page. If any line is blank, fill it before you add another agent.

[Ryan Johnson @RyanWorkforceAI]

A long-running AI agent is not a chat window that stayed open. It is a job that keeps going after you leave the room.

Once an agent runs for hours or days, chatbot habits stop being enough. Treat it like a distributed system:

• a named owner for the agent's identity and credentials
• unique credentials with the least privilege the job needs
• context that survives across handoffs, not a fresh prompt each time
• a shared registry so agents do not quietly duplicate each other's work
• a kill path and rollback that work while the run is still going
• logs of what it used and changed, not only what it returned

The question is not how many agents you can launch.
It is whether your org can keep identity, context, and ownership straight once those agents stop being short chats.

Monday check: pick one agent that has run longer than a single session. Name its owner, its credentials, and the context it still carries. If any of those three is fuzzy, fix that before you add another long-running job.

[Ryan Johnson @RyanWorkforceAI]

One of the better agent design platforms I have used is @SuperDesignDev. While @cursor_ai does a pretty good job with UI, it just can't implement the vision I have for some of my sites. What is amazing is that once you add the @SuperDesignDev connector, you can spin up a @Cursor Project, this is basically the "Project Lead", and it leverages @SuperDesignDev amazingly well. It can take my natural language prompt, and using SuperDesign, can turn that into a reality. It is exciting to see my ideas actually come to life.

[Ryan Johnson @RyanWorkforceAI]

https://t.co/sGnZxNqDbp

[Ryan Johnson @RyanWorkforceAI]

Your AI agent may already reach regulated data nobody meant it to see. In the Kiteworks 2026 survey of security and risk leaders, 63% of organizations said they cannot enforce purpose limits on what their agents are authorized to do. A policy memo is not a control.

Before the next agent goes live, lock these in:

• credentials that cover only the systems the job needs
• no path into regulated stores it was never cleared for
• a named human who owns the access list
• a review whenever the job, owner, or workflow changes
• a written kill path someone can use without a ticket marathon
• a log of what it touched, not only what it returned

The question is not whether the agent has enough access to finish the task.
It is whether anyone can prove what it is barred from, and who stops it when that bar fails.

Monday check: pick one production agent and list the systems it can reach. If the list is longer than its job, shrink it before you add another agent.

[Ryan Johnson @RyanWorkforceAI]

Wipro built an AI learning agent for about 240,000 associates. The hard problem wasn't the model. It was the catalogue.

Their AI Academy already had 144 persona-based paths and hundreds of courses from partner platforms. People still weren't sure where to start. Search and course descriptions left most of them wandering. Only a small share asked for help, and adoption suffered.

So L&D put a conversational agent, iSkill, inside Microsoft 365 Copilot and Teams. It reads role, band, function, skills, and what you've already finished, then points you at the next course that fits. Access is gated by security group. Managers can plan for a role, but the agent won't look up a person. They call it a personal learning advocate, not a surveillance tool.

Between January 2025 and March 2026, 96 percent of AI Advanced+ courses at the academy were completed.

The L&D lesson is plain. A big content library without a guide is still a library people walk alone. The agent didn't invent new courses. It made the existing ones findable for the person standing in front of them.

[Ryan Johnson @RyanWorkforceAI]

A simple test before you launch one: can someone on your team explain what the agent is allowed to do, who approves its work, and how to shut it off?

If not, that's your training plan.

[Ryan Johnson @RyanWorkforceAI]

An AI agent can get a badge, a job scope, and a probation period. It shouldn't get the blame.

A few notes on borrowing from HR to manage agents, without pretending they're people.

[Ryan Johnson @RyanWorkforceAI]

This is where L&D and HR have real work to do. Deloitte found only 1 in 5 leaders say their org is ready to redesign processes around autonomous agents.

The blockers they named: poorly documented processes, messy data, old habits. Those are ours to work on.