When one consultant tries an AI agent on a Sandbox tenant, it is an experiment. When a firm's consultants use one on every client's tenants, it is a decision the firm has to be able to defend to those clients. Five questions cover most of what a client's IT or security team will ask, and the answers differ a lot between tools.

1. Whose AI account will client data go through?

An AI agent sends what you ask, and what it reads in Workday to answer you, to an AI model. Find out which account that model runs on.

  • A person's own account (their ChatGPT, Claude or OpenRouter account). The terms are that person's, and the firm has no view of the settings.
  • The firm's business account with an AI provider, or the firm's own model endpoint. The firm sets the terms once, for everyone.
  • The tool vendor's account, when the vendor runs the AI for you. The vendor's data terms then matter as much as the model provider's.

2. Will the AI provider train on client data, and how long will it keep it?

The answer depends on the kind of account, and the providers publish it:

  • Anthropic says that "by default, we will not use your inputs or outputs from our commercial products" to train its models. It also says that conversations a person submits as feedback, with the thumbs up or down, are kept for up to five years, and that owners of Team and Enterprise plans can turn member feedback off.
  • Claude's Free, Pro and Max plans are consumer plans. Anthropic lets each person choose whether their chats help improve Claude, in their own privacy settings.
  • OpenAI says it does not train on data from its business products, ChatGPT Business, Enterprise and Edu, or from its API platform by default, and that qualifying organizations can configure how long data is kept, including zero data retention on the API.
  • OpenRouter routes to many model providers, each with its own data policy. If you opt out of training in your account settings, OpenRouter says it "will not route to providers that train."

The practical point: on a person's own consumer account, a setting that person controls decides whether client data can help improve a model. A firm that needs to promise clients "no training on your data" needs an account whose terms the firm itself controls.

3. Where are Workday sign-ins kept, and what can the agent reach?

Two designs are common. In one, the tool connects through an integration system user and API client with broad access, and the credentials sit on a server. In the other, the agent signs in as the consultant, so Workday security limits it to what that consultant can already see and do.

Ask where the sign-ins are stored, whether they ever leave the consultant's computer, and whether the agent can reach a second client's tenants from the same conversation. Each answer should be "no" for the last two.

4. Who approves each change, and what will the agent never do?

An agent that can change a client's Workday should stop before every change and show which tenant and what change. Ask what happens in a Production tenant, and what the agent refuses to do even when someone tells it to go ahead. A good answer lists specific lines, not a general promise to "be careful".

5. Who has a seat, and how is access removed when someone leaves?

Consultants change projects and firms. Ask how the firm sees who has access, on which computers, and how a leaver is signed out everywhere. Workday applies the same principle to its own Developer Site: it recommends that Company Administrators inactivate the account of anyone who leaves or moves to other projects, so they can no longer change the company's Extend apps or settings.

How kiweely answers these

Kiweely Personal is free for one person to evaluate kiweely. It runs on that person's own ChatGPT or Claude plan or OpenRouter key. Workday sign-ins stay on the person's computer and are never sent to kiweely or to the AI; kiweely receives only the person's email, their connected computers, and crash reports they choose to send. Every change waits for approval on a card that names the tenant and the change. Production changes are made one at a time and read back. It never promotes anything to Production, never installs an app in a tenant for the first time, and never turns on Full Access by itself.

When a firm uses kiweely, it needs a paid Team & Enterprise licence, priced by quote. That licence adds what questions 1, 2 and 5 call for: the firm's own AI endpoint, or AI hosted by kiweely with the data retention the firm sets and no training on its data; seat management, so the firm sees who has a seat on which computers and signs people out when they leave; shared workspaces in the firm's Google Drive or SharePoint; and a security review and data processing agreement, answered by a person.