On October 20, 2026, Japan's Digital Agency announced that it will begin offering AI agent environments in Gennai, the government AI platform, to about 180,000 government employees. "Agent Chat" is being introduced to ministries and agencies in stages starting the same day, and the agency aims to bring in "Gennai Workshop," which handles more advanced tasks, by around December. Because employees will be able to hand multiple processes to AI to suit their own work, the agency also published the "Gennai Standards," which set out the responsibilities of users, administrators, and developers. While automated execution expands, the standards spell out which operations the system restricts and where human judgment remains.
Two environments with different permission boundaries
Agent Chat is an environment that executes multiple tasks together from natural-language instructions and outputs the results as files or documents. Gennai Workshop can handle research that gathers and compares information from multiple websites, and even prototyping apps that actually run. Whereas the existing Gennai has offered chat and prebuilt AI apps, employees can now assemble a series of tasks themselves.
The mechanism for reusing work procedures is called a "skill." A skill describes the purpose of a task, decision criteria, and reference materials, and includes verification methods and how to handle exceptions, in a form the AI can execute. The introductory materials outline a plan to turn know-how accumulated by individual employees into skills and share them with other ministries and agencies through the "Gennai Library." If employees with specialist knowledge can formalize their work, colleagues and successors can use the same procedures and build on them.
However, the permissions granted to the two environments are not the same. Under the October 2026 Gennai Standards, Agent Chat runs tools within the user's own My Drive, while Gennai Workshop blocks outbound POST/PUT and similar requests and permits GET requests.
| Item compared | Agent Chat | Gennai Workshop |
|---|---|---|
| Scope of operations | Tools run within the user's own My Drive. Direct operation of the local PC is not possible | Performs file operations and command execution in succession in a dedicated environment. Customization is allowed within granted permissions |
| External connections | No direct access to APIs or MCP servers not managed by the developer | Blocks POST/PUT and similar requests used for external transmission. Permits GET needed for web retrieval, and records destinations, volume, and dates/times |
| Checks for use | Users check processing and deliverables; administrators manage at the organizational level | Unavailable by default. Administrators grant permission upon application by employees confirmed to have a certain level of capability |
The comparison organizes the security measures for Agent Chat (section 3-5) and Gennai Workshop (section 3-6) in the Digital Agency's Gennai Standards along the same items. It reflects the descriptions as of October 2026, and rollout of the workshop to general staff is proceeding toward the target date mentioned above.
Chat does not let the AI directly operate the user's PC, and the workshop places limits on how it communicates externally. Even as the range of tasks grows, the design does not execute whatever instructions employees give without limit. These restrictions alone cannot guarantee safety, however, and the standards also call for vigilance against prompt injection, in which malicious instructions are mixed into external materials. Web search in chat is processed within the Government Cloud and does not communicate with the target websites. Even so, human checks remain necessary over how loaded materials are handled and which tasks the generated results are used for.
Human confirmation before important processes
When AI executes multiple processes in sequence, the Gennai Standards require users to confirm and approve before important processes. For high-impact operations such as updating or deleting files and registering data, the user decides whether to proceed. Reading only the finished document at the end cannot address the risk that erroneous changes were made along the way.
Verifying output is also the employee's responsibility. Copying AI responses directly into administrative materials or official documents without checking is not permitted, and when they are used for administrative decisions or external explanations, the final content must be checked. The approach strengthens human control as the impact on operations grows, and cautious use is required for matters such as administrative dispositions and policy decisions. At the same time, the standards state a policy of avoiding excessive procedures, in proportion to risk, for routine and supporting work that is completed within a department.
Supporting this division of roles is the premise that employees maintain the expertise to evaluate output. The standards state explicitly: "Maintain the ability to carry out critical operations even when AI is unavailable." They ask employees not to casually delegate work whose validity they cannot judge themselves, and to maintain and improve their business knowledge and judgment while using AI.
Ministries and agencies also bear responsibility for deciding the scope of use. Administrators define the tasks and information that may be used, and manage usage permissions and incident response. The standards also impose review and approval by authorized persons on changes to the production environment for those who develop and operate Gennai. Rather than merely urging employees to use it carefully, responsibilities are divided down to organizational operations and system changes.
Conditions also apply to how information is handled. The Digital Agency operates so that information up to Confidentiality Level 2 can be handled, but that does not mean all information in the same category may be entered indiscriminately. Other ministries and agencies must define the scope and conditions based on their own regulations, and Confidentiality Level 3 information, specially designated secrets, and important economic security information cannot be handled. The prohibition extends not only to writing in prompts but also to attached files and saving to My Drive.
Management functions still under development
The "tenant administrator function," which would let administrators suspend users and configure usable models and features for each ministry or agency, is at the stage of being considered for future provision under the standards. If an incident or abnormality occurs in Gennai Workshop while this function is not yet available, the Digital Agency, upon receiving a report from the administrator, will handle suspension of use. It should not be assumed that on-site administrators can already use every control function.
A distinction also needs to be drawn between current operations and future features when it comes to records. The standards stipulate that logs of input and output content, the models used, and similar items be acquired and stored to the necessary extent, and that measures be taken to prevent tampering with the workshop's operation information. Separately, a feature that would make creating a dedicated "AI usage record" mandatory for certain high-risk tasks is under consideration for implementation. The proposal would record input data, reference information, responses, and processing times so that which information was used to produce output can be verified and audited afterward.
There are also limits on those who hold the logs. The basic policy is that Gennai developers avoid, as far as possible, personally accessing logs that include input and output content during normal operations. When necessary, access goes through approval, is limited to the minimum necessary targets and period, and both the granting of permissions and the access itself are recorded. Who can view the information collected for tracing is itself a subject of management.
What ministries and agencies need to confirm at introduction is therefore, besides the available features, who approves important processes, through what route operations are halted in an abnormality, and what is kept as records. Until the dedicated record function is in place, the question is how to build into on-site procedures the risk-based checks and history retention that the standards require.
The Digital Agency plans to release both environments as Gennai OSS Ver. 2.0 around February 2027. It anticipates use, modification, and redistribution by local governments and private companies, but the standards apply directly to the hosted version of Gennai operated by the Digital Agency and provided to ministries and agencies. Obtaining the OSS does not mean gaining the same operating framework as the government, and adopters need to establish their own procedures for information management and granting permissions.
The standards were drawn up with the cooperation of the AI Safety Institute (AISI). In future adoption, concrete decision factors will include the rollout timing of the workshop and how far the administrator functions and dedicated records are implemented. The plan to pass employees' work procedures on to other departments will also grow into a mechanism that can be used continuously in administrative practice only when accompanied by operations for confirmation, recording, and suspension.