Field notes from Workato Labs San Francisco, where enterprise AI’s hardest problems sounded oddly familiar
The room used to be an auto shop. You can still see where the lifts bolted into the floor. Workato converted it into a living lab in San Francisco, one of several worldwide, where roughly 400 developers a week now train hands-on and four to five events run weekly. On this afternoon it held a few dozen IT executives, architects and integration leads, with about 300 more watching online, gathered around a single question: what does it actually take to put AI agents to work?
Not assistants. Not demos. Work.
Reasoning Frontier
Workato CTO Adam Seligman opened with a distinction that framed the entire day. The models keep getting smarter, he noted, but intelligence alone stalls out.
“They can draft an amazing email,” he said, but “they can’t deliver it.”
No feedback loops, no coordination, no action in real systems. He calls this the reasoning frontier, and crossing it separates what he described as a tale of two companies: those putting agents to work and seeing it in business metrics, and those running business as usual.
His favorite interview question makes the gap concrete: you get an invoice. How do you pay it? If a candidate jumps straight to the agent executing financial transactions, Seligman rewinds them. “Why do you trust it?” Who is allowed to pay? The trust problem under the hood, he argued, runs far deeper than extracting fields from a PDF.
Then the second problem, the one with history behind it. If every agent handles its own identity, integration, observability and token management with every system, you get chaos. Anyone who lived through integration spaghetti, he suggested, knows exactly how that movie ends. Workato’s answer is a control and execution plane in the middle of the stack: one place for governance, identity, security and connectivity across ten thousand plus applications, now speaking MCP. “Any agent with any system and any business process,” as he put it, without the pain.
A CTO pitching his own platform is unremarkable. What gave the day its weight was how independently the other speakers, from Snowflake and Monte Carlo, arrived at the same architectural conclusion from different directions.
Single-Agent Ceiling
Okhtay Azarmanesh, Principal AI Architect at Snowflake, brought deployment scars rather than slideware. The recurring killers of enterprise AI pilots, in his telling: missing business context, governance that cannot guarantee an agent sees only what each user is entitled to see, and cost. You could run Claude Opus behind every agent “and they will be happy,” he said dryly, but the bill grows fast. Model routing, lighter models for lighter tasks, became table stakes. His sharper observation:
“The single-agent ceiling. We already hit it.”
Complex tasks broke single agents on long context and tool integration, which pushed Snowflake toward multi-agent frameworks just as MCP took off. He compared the protocol to a USB-C port, a standard that turns bespoke integrations into modular connections, and walked through how Snowflake now layers governance on top: access enforced at account, server, agent and user level simultaneously, with credit budgets per team so cost control travels with permission control.
Then he mapped the architectural fork many in the room seemed to be facing. Centralized, where one gateway fronts all tools: simple setup, one integration, but naming conflicts and shared blast radius as it grows. Distributed, where each domain owns its server: clean separation, harder security and configuration. His prediction carried the most signal: the industry is converging on centralized orchestration today, but the pattern echoes computer networking’s own evolution, and as security matures
“we will move toward more decentralized patterns.”
A question from the floor pressed on exactly that historical rhyme. Robert Schwentker (yours truly) noted the API era followed a similar same arc, monolithic surfaces giving way to decentralized ones. I asked: when MCP servers face customers, who publishes and maintains those discovery contracts? Loose conventions or governed registries?
Azarmanesh’s answer located the issue seemingly where the rest of the day kept landing: trust placement. Whoever owns the server owns the contract, but only strong access controls make that ownership safe regardless of who builds on it. He then volunteered the gap that genuinely concerns him. Today’s pattern puts all planning in a heavyweight orchestrator that delegates to lighter models. The more interesting future is agents deciding for themselves when to escalate, when to hand off, when to collaborate. “The collaboration, the team playing,” he said, “is the gap.” The models are individually brilliant and collectively clumsy.
N-Cross-N, Again
Rahul D. Dureja, Chief Strategic Architect at Workato, gave the day perhaps its bluntest thesis. Roughly 40 percent of companies report AI in production while two thirds report being stuck scaling it. His diagnosis: “The problem is not the agent. It’s not the model.” Agents lack a bridge to enterprise applications, and AI’s probabilistic nature collides with processes that must run identically every time.
MCP solved the first problem and quietly recreated an old one. Point-to-point agent connections multiplied until, in his words, “N-cross-N is a reality.” The industry moved integration spaghetti up a layer. His historical analogy did real work here: APIs existed in the early 2000s, but enterprise practice only emerged with the API gateway, the construct that let organizations govern consumers, policies and exposure.
“Your MCP gateway,” he argued, “is the same construct for the agent decade, wrapping context, authentication, composable business processes, human-in-the-loop checkpoints and full auditability around every agent action.”
The architecture also future-proofs: models and frameworks churn weekly at the top of the stack while business processes, the assets built before AI, stay stable underneath.
The proof came from a small healthcare POC his team ran, and it was the most quietly damning demo description of the day. A patient-scheduling agent built two ways. Version one: a server exposing multiple raw tools, including some the agent should never touch. Version two: one intent-based tool wrapping the orchestrated process. The first agent sometimes checked insurance before booking and sometimes did not, confused dermatology with cardiology for chest pain, “silently swallowed an error,” booked appointments with no date and occasionally told users a booking existed when nothing happened. Same model. The second version behaved identically every run. The model was never the variable. The architecture was.
Trust, Measured in Stoplights
The fireside chat between Carter Busse, who leads developer relations at Workato, and Barr Moses, CEO and co-founder of Monte Carlo, turned from architecture to adoption, and produced probably what was the day’s most down to earth material.
Moses described rolling out Claude company-wide early last year. Initial excitement, shallow usage, plateau. The inflection came when practitioners connected MCP servers to internal systems, Salesforce, Jira, the works, and suddenly salespeople could interrogate data the way engineers could. “That was really the inflection point,” and adoption went, in her words, through the roof. Busse described a similar dynamic at Workato, where Claude became “the first line of defense” for any internal question, often outperforming colleagues because it holds the institutional memory humans only think they hold: the Slack thread from fifty conversations ago, the Salesforce field someone filled in a year back.
“We make more mistakes than the agents do,” he said. “That’s the real truth.”
The enablement story deserves attention from anyone running a rollout. Standing up MCP servers changed nothing until Workato ran live sessions at 8am and 5pm, every day, for two weeks. Then leaders started requesting sessions for their teams unprompted. A recruiter reported a transformed role. The cost story deserves equal attention: token-based pricing once spiked Workato’s bill to a thousand dollars a day, which taught a durable lesson. You do not need the most powerful model for most tasks.
Moses was at her best on the psychology of autonomy. Monte Carlo built a troubleshooting agent that takes an incident, generates hypotheses and spawns an agent per hypothesis to investigate recursively, compressing what took a human analyst a week into about 12 seconds. Another internal agent reviews its own feedback nightly, identifying broken MCP connections and stale data, and “fixes itself” while the company sleeps. The capability for autonomous loops, she argued, already exists. What lags is us.
“Our psychology for when we’re ready for autonomy is totally divorced from the technology.”
Her sharpest line landed on why.
“Data has been lying to us for years,” she said. “It’s just been doing it silently.”
Agents lie with confidence and citations, which paradoxically triggers more scrutiny than the quiet corruption everyone tolerated for decades.
An audience member asked the question which seems like every regulated industry is circling:
“Is there a rubric for deciding what runs autonomously versus human-in-the-loop?”
Moses reached for a metaphor with real explanatory power.
“Before stoplights, human beings stood in intersections raising flags, and society gradually decided the lights could be trusted.”
Her answer for now is range, not rubric: Monte Carlo serves banks and startups alike, so the platform supports fully gated through fully autonomous, and each organization negotiates its own timeline. Enterprise security and controls, she added, become more important as autonomy increases, not less.
Asked what she would do differently, Moses gave an answer that inverted her own leadership philosophy. She prides herself on making as few decisions as possible, pushing them to people smarter than her. AI broke that model. The shift was too disorienting for individuals to choose their way into it alone. “I should have made the harder decision for people a long time ago.” Busse’s regret ran parallel: waiting too long to let agents take real actions in enterprise systems, where the actual unlock lives.
Interface Becomes Agent
A closing question from the floor, again from Schwentker, framed as a dream big question, pushed the frame outward:
“In the spirit of dreaming big: MCP today mostly governs internal consumption, exposing internal resources outward. But how are companies thinking about agents reaching across organizational boundaries, becoming agentic-first externally, the way Sierra’s Brett Taylor describes websites becoming agents, the interface between outside & inside?”
Busse called it the future without hedging, describing a decades-old company sitting on mountains of data now redesigning itself so agents can discover and pay for it. Moses broke the imperative into three tests every company now faces. Discoverable: when an agent needs what you sell, does it find you? Procurable: can an agent easily buy and deploy you? Serviceable: once an agent is your customer, can you support it? Every team at Monte Carlo, she said, has had to re-ask its role against those tests. Agents purchasing products, negotiating with support, finding babysitters: “It’s not science fiction.”
The timing of the question was almost too neat. Days earlier, Cloudflare CEO Matthew Prince had posted that agentic traffic had passed human traffic online for the first time, by Cloudflare’s observed measure, though reporting noted the exact crossover day stays fuzzy because the data is messy. The threshold may be imprecise. The direction is not.
Which loops back to the question that opened the floor and never quite closed. The API era eventually produced gateways, registries, contracts and trust infrastructure, after years of sprawl. The agent era is speedrunning the same curriculum, except this time the consumers on the other side of the contract reason, improvise and occasionally hallucinate. Everyone on stage agreed the constraint is no longer intelligence. It is architecture, governance and a species still deciding whether to trust the stoplight.
When the majority of your traffic can read your documentation, evaluate your offering and complete a purchase without a human in the loop, who publishes the contract? And who do they publish it for?
Workato Labs San Francisco hosts public sessions weekly. Workato’s World of Automation conference runs this September in Las Vegas.
bsky.app/profile/schwentker.sandboxlabs.ai/post/3mo2sck5evs2i