Workday opened its human resources and finance rules to any agent that speaks Model Context Protocol, then agreed to buy C1.ai to govern what those agents can reach.

An agent that approves an invoice exception from inside Claude never opens a Workday screen, and Workday built its October 13 announcements around that scenario. The company made its Trusted Agent Platform headless and agreed to acquire C1.ai, an identity governance company. Once agents act on payroll and finance data, your audit team will ask who authorized each action, and Workday's answer arrives in pieces, some shipping today and some in 2027.

Workday is selling its rules to agents that never log in

Workday announced that its Trusted Agent Platform is headless, which lets customers build and run agents across human resources, or HR, and finance without anyone signing in to Workday. Access comes through Agent-Ready Tools, Workday's tools for the Model Context Protocol, or MCP, an open standard for connecting agents to business systems.

Any agent that supports MCP gets an approved way to read Workday data and take action, and each request carries the requester's identity and the approvals that apply. A second tool, Live Data Query, lets teams and agents question live Workday data in Structured Query Language through Workday Data Cloud, so a dashboard and an agent read from one governed source with no extra copies.

Agent Harness runs every agent deployed on the platform, whoever built it, and supplies the context a task depends on, including the person's role and reporting line. Customers pick the model for each agent, and the platform added NVIDIA's Nemotron open models next to Claude and Google's Gemini.

Workday lists Agent Harness, Agent-Ready Tools, Custom Agents, Developer Agent, and Data Cloud as released for general use today, so you can test the headless claims this quarter.

A permission model is the product when no one opens the screen

In March I wrote that Sana is the front door to work inside Workday. Workday is moving that door outside its own walls: Sana, the new Workday Home screen, will reach employees in Claude, Gemini Enterprise, Microsoft Copilot, and Slack, according to the announcement.

The partnership with Anthropic takes that idea furthest. In Claude, an employee can analyze Workday data and act on it, and Workday says the user confirms every change while Claude limits what it surfaces to what that person is permitted to see.

The relationship runs both ways. Anthropic runs its finance and people operations on Workday Financials and Workday Human Capital Management, and Workday uses Claude Code in its own product development.

The Sana in Claude plugin is in early access with general availability expected in late 2026, while Agent-Ready Tools are released for general use today through Workday Extend AI.

Buyers will judge the system of record by its audit trail once agents from other vendors act on Workday data.

C1.ai extends Workday's reach from its own data to the systems agents touch

C1.ai connects to systems as different as email and cloud infrastructure, then grants and removes each person's or agent's access as roles change. Workday records every job change in a company, from hire to exit, so it holds the event that should trigger an access change.

C1.ai's own research, which Workday cites in the release, found that 95% of large U.S. companies run autonomous agents (C1.ai, 2026). Deloitte's State of AI research puts the share of companies with a mature way to govern those agents at 21% (Deloitte, 2026). The first figure comes from the company Workday is buying, so count the agents in your own environment before you adopt it.

The Workday Agent System of Record registers agents, and C1.ai would add control over what each registered agent can reach across Workday and other systems, including removing access the moment an agent retires. Both your directory team and your HR team will have an opinion on the same agent, and someone has to decide whose record wins.

Workday did not disclose terms in the release. The transaction is expected to close in the fourth quarter of Workday's fiscal year 2027, which ends January 31, 2027, subject to customary closing conditions.

Autopilot and policy checks arrive in 2027, which gives you time to test them

The Talent Acquisition Agent is the first autopilot. It watches the requisition queue and drafts candidate outreach, and a recruiter approves anything sent to a candidate. Early adopters have it today, and general availability is planned for early 2027.

Payroll and accounting agents follow in early 2027, along with a Deployment Agent that flags release features a customer has not turned on. Close to 5,000 customers have activated the Deployment Agent since Workday announced it last September (Workday, 2026).

Workday's research found that large language models can misapply HR policies even with the correct policy in front of them, which is the problem Grounded Reasoning targets.

If a manager asks an agent to move someone into a role the manager lacks authority to fill, Grounded Reasoning would stop the agent, explain why, and point to the right next step. It enters early access in early calendar 2027, and Agent Context Service, which supplies the Workday context an agent needs before it reasons, enters early access in late 2026.

Until those arrive, the permission model carries the load: customers choose which actions an agent takes alone and which need review, and they can set how often agents run to control cost.

The releases leave pricing and audit custody open

• Pricing for agent calls and Live Data Query, which the releases do not state.
• How audit evidence from an action taken in Claude reaches your own auditors, since Workday says its audit controls apply but does not describe the export.
• How C1.ai access decisions will coexist with the directory and approval flows you run today, which depends on integration work after the close.