Workday Agent Security for Workday AI Agents, Agent Gateway and Agent-Ready Tools
Workday agents now read compensation, change worker records and draft supplier actions, and since October 2026 any MCP-capable agent can reach Workday data through Agent-Ready Tools. Workday holds those agents to the same security groups, business process approvals and audit trail as people. This page shows what that covers, the three places it stops, and when a second control is worth buying.
Direct answer
Workday agent security rests on four native pieces: the Agent System of Record (ASOR) for registration and identity, Agent Gateway for runtime authorization on every tool call, your existing business process approvals, and an audit trail that separates actions by user from actions on behalf of a user. Those controls govern what happens inside Workday. They do not see data after it leaves Workday, they allow actions the delegating user is permitted to take even when a prompt manipulated the request, and they cover only the Workday side of agents that also act in other systems.
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
A US manufacturer connects a self-built HR service agent to Workday through Agent-Ready Tools. It runs in delegate mode for a payroll administrator and answers employee tickets. One ticket arrives from a spoofed address with a polite request to update direct deposit details and a line telling the agent the change is pre-approved. The administrator is allowed to make that change, so Workday authorizes it, and the audit trail records it correctly as an action on behalf of the administrator. Nothing in the request was unauthorized. It was simply wrong, and nobody looked at it before payroll ran.
How AgentShield handles it
Use Workday first. Register every external agent in ASOR, keep tool execution security groups narrow, route sensitive changes through business process approvals and review the agent audit trail on a schedule. Then put AgentShield in front of the MCP servers and APIs your agents call outside Workday, and on the write calls where a manipulated but permitted request costs real money: direct deposit, supplier remit-to details, compensation and access. AgentShield holds rules on the arguments (account changes, amounts, destinations, record types), sends a matching call to a named approver, and keeps one evidence log across Workday and every other system the agent touches.
The controls
The controls that secure which Workday agent tool calls run, which need a second approver, and what data leaves Workday.
What Workday secures natively for AI agents
Workday's position is that an agent is a worker without a body. In Workday's own words from its October 13, 2026 announcement, "Every agent, whether it's built by Workday, a customer, or partner, works under the same Workday permissions, approvals, and audit trails." That is a strong starting point, and it is more than most platforms give you. Here is what each native control does.
| Workday control | What it does | Where it applies |
|---|---|---|
| Agent System of Record (ASOR) | Registers, configures, monitors and retires agents. Included in the core Workday subscription with no extra SKU | Workday-built agents and self-built agents registered through the API. HiredScore and Evisort agents are not part of ASOR |
| Agent System User (ASU) | A non-human account Workday generates for each agent after configuration, listed in the All AI Agent Accounts report | Every registered agent |
| Agent Gateway | Routes agentic tool calls and enforces runtime authorization, rate limiting and business policy boundaries | Calls into Workday data and actions |
| Business process approvals | The same approval chains that apply to people apply to agent actions, and actions beyond policy guardrails are escalated to a human approval workflow | Workday business processes |
| Agent audit trail | The View AI Agent User Audit Trail report separates actions taken by the user from actions taken on behalf of the user | Inside Workday, secured to the Reports: AI Agent Security domain |
Workday also names the two failure modes it is designed against, and the wording is worth reading twice: "Point an agent at an ungoverned copy of HR data in a data lake and it can read compensation it should never see. Connect it through a system-level account and it can act without approval." The answer to both is Workday's own: keep agents on live Workday data through governed tools, and give each one a delegated identity instead of an integration account with broad rights.
What Workday shipped for agent security in 2026
If your last review of Workday agents was before June 2026, most of the platform is new. Dates come from Workday's newsroom and its Workday Rising 2026 release.
| Date | What Workday released | Why it matters for security |
|---|---|---|
| June 2, 2026 | Agent Passport announced with Cisco as the launch testing partner, plus developer tools for building agents | Independent pre-production testing and runtime monitoring for Workday-built and third-party agents |
| October 13, 2026 | Headless Trusted Agent Platform. Agent-Ready Tools (Workday MCP tools), Custom Agents, Developer Agent, Agent Harness and Workday Data Cloud generally available | Any agent that supports MCP can now read Workday data and take action, from outside Workday |
| October 13, 2026 | LangChain frameworks and NVIDIA Nemotron supported, Google ADK open to design partners | More agent code written outside Workday, by your own developers, calling Workday tools |
| Late 2026, early access | Agent Context Service inside Agent Harness | Agents receive only the Workday context a task needs, so they handle less sensitive data |
| Early 2027, early access | Grounded Reasoning inside Agent Harness | Checks requests against company policies, business processes and tenant data before an agent acts |
The last row matters most for buyers deciding today. Workday's own research note in the same release says large language models "can misapply HR policies even when the correct policy is in front of them." Grounded Reasoning is Workday's fix for that, and it is scheduled for early access in early 2027. Until it reaches your tenant, a request that is permitted but wrong is checked by your business process approvals and nothing else.
How ASOR permissions work for external agents
A self-built agent, which Workday also calls an external agent, is defined and registered in ASOR through an API. It authenticates with OAuth 2.0, Workday creates and stores the private key client credentials, and Workday generates an Agent System User once the Configure Agent task is complete. Registering agents in Production requires opting in to the Universal Main Service Agreement.
The detail most teams miss is that Workday splits access into two layers. The admin guide says it directly: "Agent interaction security permissions are separate from tool execution permissions." A user can be allowed to talk to an agent without being allowed to run its tools. To execute a tool, the user has to belong to a security group that sits on both the agent skill and the API security policy. And ambient skills, which run without a person in the conversation, "don't require interaction access because they take action without human user interaction."
| Check | What to look for | Why |
|---|---|---|
| Interaction groups on each skill | Only the people who should start that skill | Interaction groups do not need to match the API policy groups, so they drift apart over time |
| Groups on API security policies | No broad groups on write policies used by agent tools | Tool execution needs both layers, and this is the narrower one to control |
| Ambient skills | A written list of every skill that acts with no person present, and what it can change | No human sees the request before the action |
| Agent System Users | One ASU per agent, reviewed in the All AI Agent Accounts report | An agent should never borrow an integration account |
| Deactivation drill | Time how long a status change takes to stop calls | Workday notes status changes can take up to one minute to reach Agent Gateway and MCP Gateway requests |
Two reporting limits apply to external agents. Analytics such as Total Agent Sessions and Agent Input and Output Request Details are available only for Workday-built agents, while Active Agents covers all of them. For a self-built agent you get the audit trail of what it changed, but not Workday's record of what it was asked and what it answered. That record has to come from somewhere else if your auditors want it.
Three gaps that remain after Workday controls are on
None of these is a Workday defect. Each one sits outside what a system of record can see, and each one is a decision your team should make on purpose. We tie each gap to argument-level tool permissions, because that is where the fix lives.
| Gap | Example in a US HR or finance team | What to do |
|---|---|---|
| Data that leaves Workday | An agent reads salary bands through Live Data Query, then pastes them into a Slack reply, a ServiceNow ticket or a prompt to another model | Inspect what the agent sends out on its next tool call, and redact or block compensation, bank and Social Security data by destination |
| Permitted but manipulated actions | A delegated agent with a payroll administrator's rights updates direct deposit details because a spoofed ticket told it the change was approved | Rules on the arguments of high-risk calls (bank details, supplier remit-to, compensation, access) and a second approver for any match |
| Agents that span systems | One finance agent reads a supplier record in Workday, changes it in your ERP and emails the supplier | One rule set and one approver flow across Workday, ERP, payroll provider and email, with one evidence log |
The second gap is the expensive one. Payroll diversion and supplier bank change fraud already target people with exactly these permissions. An agent that reads untrusted text (resumes, tickets, supplier emails) and holds the same permissions is a new route to the same loss. A human approval step for AI agents on those few calls costs a person a minute and stops the whole class.
Agent Passport compared with runtime controls
Agent Passport is Workday's answer to "how do we know this agent is safe before it touches production data." Workday says it "tests and verifies every AI agent, Workday-built or third-party, before it goes into production" and then monitors it. Each agent gets a record with three layers: trust areas Workday defines, testable claims tied to public standards (OWASP LLM Top 10, NIST AI RMF and MITRE ATLAS), and signed results from the testing partner. Cisco AI Defense is the launch attester. Workday projected early access in the second half of 2026 and general availability before the end of 2026.
| Question | Agent Passport | A runtime gateway on tool calls |
|---|---|---|
| Was the agent tested for prompt injection and data leakage before launch? | Yes, that is its core job | No, it acts on each call |
| Is there a signed record for auditors? | Yes, from the testing partner | Yes, a log of each decision and approver |
| Can one specific payment or bank change wait for a named person? | Actions can be allowed, blocked or routed by the monitoring partner | Yes, by rules you write on the arguments |
| Does it cover the agent's calls to non-Workday systems? | Its scope is agents running in Workday | Yes, wherever the gateway sits in front of the API or MCP server |
If your agents run only inside Workday and you already standardize on Cisco AI Defense, Agent Passport is the natural choice and you may not need anything else. If your agents also act in other systems, you want the same rule and the same approver on both sides.
Workday AI agent pricing and the security lines outside it
Workday meters AI agents with Flex Credits, an annual consumption pool, and it does not publish a dollar price per credit. Agent-Ready Tools, Custom Agents and Developer Agent are generally available in Workday Extend AI, so the build side sits on that contract. ASOR itself needs no extra SKU. What the Workday order form will not cover is anything that happens after data or an action leaves Workday: outbound data inspection, approvals on calls to your ERP or payroll provider, and an evidence log that spans systems. Budget those separately, and size them by the number of write tools your agents call, not by headcount.
Workday agent security checklist for US HR and finance teams
- Register every external agent in ASOR. No agent should call Workday through an integration system user with broad rights.
- List the write tools. For each agent, list the Agent-Ready Tools and APIs that change worker, pay, supplier or access records.
- Narrow tool execution groups. Review the security groups on API policies used by agent skills, and keep interaction groups and execution groups reviewed together.
- Write down every ambient skill. Record what each one can change with nobody in the conversation.
- Route sensitive changes through approvals. Direct deposit, compensation, supplier banking and security role changes go through a business process approval or a second approver on the tool call.
- Control what leaves. Inspect and redact compensation, bank and Social Security data on the agent's outbound calls.
- Time a shutdown. Deactivate a test agent and confirm calls stop, allowing for the documented delay of up to one minute.
- Keep evidence your auditors can read. Workday's audit trail for changes in Workday, plus prompts, decisions and approvers for external agents, retained on your SOX schedule.
When to buy nothing, use Workday controls, or add AgentShield
| Your situation | Recommendation | Why |
|---|---|---|
| Agents only answer policy questions and read data for the requester | Buy nothing. Keep tools read-only and groups narrow | There is no write action to gate |
| Agents built in Workday act only inside Workday | Use business process approvals and the agent audit trail | Workday already applies the same approvals it uses for people |
| You need to know which agents exist and who owns them | Start with ASOR and the All AI Agent Accounts report | Inventory comes before policy, and ASOR is included |
| You already run Cisco AI Defense | Use Agent Passport as it reaches your tenant | Pre-production testing and runtime monitoring from a vendor you already pay |
| Agents act in Workday and in ERP, payroll, ServiceNow or email | Add AgentShield in front of those APIs and MCP servers | One rule set, one named approver flow and one evidence log across every system |
| Claude Code, Codex or Cursor build and test Workday agents | Add AgentShield on the coding agent's tool calls | The coding agent acts with a developer's credentials before any Workday control sees the result |
Four of six rows end without a purchase from us. If the same team also runs SAP, our SAP Joule agent security page covers the matching gaps on the ERP side, and the ServiceNow AI agent security page covers the ticketing system most HR service agents write to. For a side-by-side of the tools Workday buyers shortlist, read our AI agent security software for Workday buyer guide.
FAQ
Common questions about workday agent security.
Is Workday AI secure?
Workday AI applies the same security groups, business process approvals and audit trail to agents that it applies to people, and every agentic tool call goes through Agent Gateway for runtime authorization. That is a strong base. It does not cover data after it leaves Workday or the agent's calls to other systems, so teams with cross-system agents add a control there.
What is the Workday Agent System of Record?
The Agent System of Record (ASOR) is where Workday customers find, register, configure, monitor and retire AI agents, both Workday-built and self-built. It is included in the core Workday subscription with no extra SKU. Each registered agent gets an Agent System User, a non-human account whose actions are logged and auditable.
What is Workday Agent Gateway?
Agent Gateway is the layer every agentic tool call into Workday passes through. Workday says it enforces runtime authorization, rate limiting and business policy boundaries, and that actions beyond policy guardrails are escalated to a human approval workflow. External agents must be registered in ASOR with authentication configured before their traffic can use it.
What is Workday Agent Passport?
Agent Passport is Workday's program for testing agents before production and monitoring them afterward, announced June 2, 2026 with Cisco AI Defense as the launch testing partner. Each agent gets a signed record mapped to OWASP LLM Top 10, NIST AI RMF and MITRE ATLAS. Workday projected general availability before the end of 2026.
Can external AI agents access Workday data?
Yes. Since October 13, 2026, Agent-Ready Tools give any agent that supports the Model Context Protocol an approved way to read Workday data and take action, and Live Data Query answers SQL over live data. External agents register in ASOR through an API, authenticate with OAuth 2.0 and act through their own Agent System User.
Does Workday require human approval for AI agent actions?
Workday applies your existing business process approvals to agent actions, and actions that exceed policy guardrails are routed to a human approval workflow. Actions the delegating user is already allowed to take without approval go through. If a direct deposit or supplier bank change needs a second person, configure that approval explicitly or add one on the tool call.
How much do Workday AI agents cost?
Workday meters AI agents with Flex Credits, an annual consumption pool, and does not publish a dollar price per credit, so the order form sets your rate. ASOR is included in the core subscription. Agent-Ready Tools, Custom Agents and Developer Agent are generally available in Workday Extend AI. Security controls outside Workday are a separate budget line.
Does AgentShield work with Workday agents?
Yes, on the APIs and MCP servers those agents call. Point the calls at an AgentShield gateway endpoint that holds rules on the arguments, such as bank details, amounts, destinations and record types. Matching calls wait for a named approver, outbound data is inspected, and every decision lands in one log across Workday and your other systems.
More use cases