Find the next check for a stale Workiva report.
Investigate the refresh, query and source evidence behind a report. Check a CSV against a permitted Wdata schema before loading it.
Lockfield’s Workiva plugin remains a private pilot. Version 0.4 adds source-grounded report diagnostics and local CSV checks. Findings distinguish observed evidence from unknowns and identify the next useful check.
The tested private pilot uses a Codex-compatible client. Hosted ChatGPT onboarding and public directory availability are pending.
Start with the work in front of you.
A report still shows last month. A CSV needs checking before a load. A Chain failed before a deadline. The plugin reads permitted native data so the conversation can refer to the actual object and its state.
For a stale report, it combines an existing connection’s refresh state with accessible query and source-dataset evidence. An explicitly selected destination can be checked when its identity matches the native connection. The result is an explanation of what was observed, what remains unknown and which check to make next.
What version 0.4 can do
The private implementation has 34 scoped tools. The prepared managed edition has 27 read-only tools and no change tools. Both keep access limited to permitted objects and distinguish live Workiva from synthetic demo data. Spreadsheet reads are limited to 2,000 cells per request; collections and result rows are bounded.
| Workiva area | Read and diagnose | Private-edition changes |
|---|---|---|
| Spreadsheets | Read a bounded cell range and native source metadata. Inspect an exact destination snapshot when its report identity matches the data connection. | Prepare an exact cell edit with its spreadsheet, sheet, range, and value matrix. |
| Documents | List sections, read section text, and inspect native content tables. | Prepare a text insertion at a selected paragraph and offset. |
| Wdata tables | Inspect schema and dataset state. Screen a supplied CSV for supported header, type, required-value and key issues, with row references and exact numeric totals. | No dataset upload, replacement, or schema change in this version. |
| Queries | Inspect saved queries, check a SELECT draft locally, and read existing jobs and bounded result rows. | Prepare a run of an existing authorized saved query with reviewed parameters. |
| Data connections | Diagnose a report refresh from permitted connection, query and source-dataset evidence. Return observed findings, missing checks and one next useful check. | Prepare a refresh of one authorized connection. |
| Chains | Inspect a Chain and its runs, including bounded failure metadata. | Prepare a run of one authorized Chain in its permitted environment with reviewed inputs. |
Report diagnosis reads at most three permitted source tables and 25 items per history, dataset or result collection. Partial links and bounded history cannot establish a complete dependency graph or identify an unobserved query execution. Draft query screening remains a local SELECT/dependency check; it cannot save or execute a draft or prove that Wdata accepts the SQL.
Check the draft before the data load.
Supply the CSV content and identify the permitted Wdata table. The local check reads native schema, reports supported header, row-width and type issues, and checks required values where the schema explicitly identifies them. Add a key only when your team has established the intended grain.
The result includes source row references, retained issue counts and exact numeric totals in source units. A malformed value stays an issue. Partial totals stay marked incomplete; duplicate-key rows are not silently deduplicated.
Keep the limits visible.
The check accepts up to 262,144 UTF-8 bytes, 1,000 data rows and 64 columns. It preserves text instead of silently trimming values or converting currency marks. Unsupported native types and unstated requiredness stay unresolved.
No CSV is uploaded, imported or used to replace a dataset. A local pass does not establish native import acceptance, the fiscal period, amount units or accounting correctness. The operator loads the data through the normal Workiva process.
Private changes still need a separate review.
The managed read-only edition has no preparation, apply, refresh or Chain-start tools. The separate private edition can store an exact supported change for human approval. The assistant has no tool that grants its own approval.
Apply uses the approved proposal once, checks its recorded state and reads back the relevant native result. An uncertain outcome stays uncertain and is not automatically retried.
What still needs a Workiva check
A completed job may still need a destination check, link publication or document review. The plugin cannot export reports or inspect rendered page layout, and successful jobs do not prove the destination numbers are correct.
Spreadsheet preflight and readback cannot lock out every external writer. A live change needs a clear owner for the range and its recovery path.
What has been tested
The service has automated checks for authentication, tenant boundaries, object ownership, proposal approval, expiration, replay prevention and MCP calls. Version 0.4’s diagnostic fixtures cover failed refreshes, missing evidence and destination identity checks. Local CSV fixtures cover supported types, malformed rows, duplicate keys and exact numeric totals.
The October 1 native acceptance record contains 33 bounded GET checks across all six Workiva areas, plus a spreadsheet cell edit, readback and overwrite rollback, and a plain-paragraph text insertion in a document. The writes used newly created synthetic Workiva files. This historical record is separate from the new local and diagnostic fixture tests.
Saved-query execution, connection refresh and Chain start retain synthetic test coverage only. Representative native reads do not establish every query result, failed run or customer permission pattern. Every customer connection and enabled action still needs dedicated sandbox acceptance; hosted ChatGPT selection and public review remain pending.
The October 1 build article describes the initial pilot and its evidence boundaries.
What a pilot needs
- A Workiva subscription and enabled APIs for the surfaces in scope.
- An administrator-approved integration identity with the required Workiva permissions.
- A configured workspace and supported regional API routes.
- An explicit list of users, connections, permitted objects, and allowed actions.
- A dedicated sandbox, an owner for each write surface, and a readback plan.
- A Codex-compatible client and an operator-managed SSH route to the private service. ChatGPT requires a separately deployed and accepted HTTPS service.
Credentials stay in the service environment. Do not paste API secrets or confidential files into an inquiry. The pilot first proves access and reads; write acceptance is a separate step.
Common questions
Can I use it in ChatGPT today?
The tested private route is SSH stdio in a Codex-compatible client. Hosted ChatGPT onboarding has not been deployed or accepted. A prepared read-only edition still needs its authenticated HTTPS connection and intended-host testing.
Can I install this from the public plugin directory?
The current version is a private pilot. Public directory availability and a public connection service are still pending. Contact Lockfield to discuss a supported pilot; this page is not a public install link.
Does it connect to every file I can see in Workiva?
It uses a configured Workiva API integration identity and an explicit list of permitted objects. An integration identity may have different permissions from a human user. The service also checks the user, tenant, connection, and action before returning data or preparing a change.
Can it check a CSV before I load it?
It screens supplied CSV text against a permitted Wdata table schema for supported header, row-width, type, required-value and exact-text key issues. It returns row references and exact numeric totals with completeness limits. It does not upload or import the data, verify period or units, or establish accounting correctness.
Can it change Workiva data?
The prepared managed edition is read-only. The separate private edition implements five change families: exact spreadsheet cell edits, document text insertion, saved-query runs, connection refreshes, and Chain runs. The October 1 live record proved a cell edit and rollback and a plain-paragraph insertion in new synthetic Workiva files; the other three have synthetic test coverage only. Each change needs a permitted target, separate human approval and dedicated sandbox acceptance.
Does a diagnosis prove that a report is ready?
It explains observed source and refresh evidence, preserves unknowns and gives the next check. It cannot establish a complete dependency graph, financial reconciliation, link publication, exports or page layout. A completed job or a matching destination snapshot alone does not prove report readiness.
Does it replace Workiva AI or Workiva’s native tools?
It is a Lockfield service for a scoped workflow. Your administrator should compare it with the tools already available in your Workiva subscription and choose the route that fits the team’s access and operating needs.
Bring one workflow to the pilot.
Tell us which report has not updated, which data load needs checking, or which Chain your team needs to understand. We will scope the permitted access and the checks required. Every engagement starts with a fixed-fee Workiva diagnostic.
Discuss a private pilotWorkiva data and integration services