workday/workdaydeveloperprogram/workday-ai-gateway-skill

Workday AI Gateway

Review the Gateway or AWS call. Report only genuine problems. The page still follows workday-pmd. The flow still follows workday-orchestrate.

Rules

• Call the Gateway from an orchestration or an Extend endpoint inside the Workday boundary. Do not send worker documents from the browser to a public model.
• Follow the call shape in the catalog sample you opened. Do not invent a Gateway path.
• Treat model output as untrusted until the page or flow validates required fields.
• Call AWS from the orchestration, not from the page. Store credentials in the tenant secret store.
• Never write a secret, tenant host, access key, or webhook into a page, an AMD, or this skill.

Output format

For each issue, state the file and line, name the rule, and show a short before and after. Skip clean files.

Test questions

• "Where should the AWS secret key be stored?"
• "Can the page call Textract directly?"
• "The model omitted a required field. What should the flow do?"