Your GRC platform added a chat panel. That isn't agent-native.

The demo is always the same now. Someone opens a control, a panel slides in from the right, and the assistant summarises the control description. Then it drafts a test procedure. Then everyone nods.

What you have watched is a language model doing something to a document. It is genuinely useful — drafting is real work and I would not give it back — but it is not what the word “agentic” is being sold to mean, and the gap between the two is where most of this year’s procurement budget is going to disappear.

The distinction

Agent-added means an assistant was attached to an existing product. It can read what is on the screen, write text into fields, and answer questions about content. Its ceiling is set by the fact that the underlying records are documents: a control description is prose, a workpaper is a file, a conclusion is a paragraph. You can summarise those. You cannot execute them.

Agent-native means the data model was designed so that work is structured and addressable. A control is a record. A test is a definition with a population, criteria and exception logic. An exception is an object with evidence attached. A conclusion has an approver. Given that, an agent can be handed “perform this test” instead of “write about this test”, and what comes back is a result rather than a paragraph about a result.

The second thing agent-native implies, and the one almost nobody mentions: the permission model has to treat an agent as a first-class actor with its own scope. If your system only understands users, then an agent operating in it is either impersonating someone or running as an admin. Both are bad answers, and the second is the one most pilots quietly choose.

The test

Ask a vendor this, and hold them to the whole sentence:

Can an agent complete one unit of work end to end and leave a record an auditor would accept — the control it tested, the population it pulled, the exceptions it found, and the named human who approved the conclusion?

Watch which half of the sentence they answer. “It can help you write that up” is agent-added. “It drafts the memo” is agent-added. A demo where a human clicks through every step while the assistant narrates is agent-added with extra steps.

The follow-up that settles it: what happens to the agent’s output before it becomes part of the record? If the answer is “it appears in the file”, the vendor has built something worse than useless for assurance work — an unsigned conclusion. If the answer is “it becomes a proposal that a named person accepts or rejects, and the acceptance is recorded”, you are talking to someone who has thought about it.

Why the data model is the whole story

We publish 138 workflow templates — audit, SOX, controls, regulatory and GRC. Between them they define 1,502 discrete steps, an average of 10.9 per template. Every one of those steps names a role, a line of defence, and the unified controls it operates.

That structure is boring and it is the entire point. A step defined that precisely can be assigned to a person, or to an agent, without changing anything else about how the work is governed. A step that exists as a sentence inside a Word document cannot be assigned to anything.

This is why “we’ll add AI” was never going to be sufficient for the incumbents, and why the pace of their announcements is not evidence of progress. Retrofitting structure onto a document store is not a feature release; it is a rewrite of the thing the product is. Some of them will do it. It will take years, and their customers will pay for both versions.

What I would actually do this quarter

Not buy anything. Take one control — ideally a privileged-access review, because the data is reachable and the exceptions are real — and write it as a definition: population, source, criteria, exception logic, evidence, approver. Then run it against the full population once, by whatever means you have.

You will learn two things. The first is what your control environment actually looks like when you stop sampling it. The second is whether your current platform can hold the answer in a form you can re-run next quarter. That second finding is the procurement decision, and it costs a week rather than a cycle.

In practice

The MCP surface CoworkCanvas exposes is seven tools — read the schema, read the current context, query data, upload and download documents, and propose a change. That last one is the one that matters: an agent proposes, a named human approves, and the approval becomes part of the record rather than a note about it.