Workday Buys C1.ai to Govern the AI Agents Joining Your Workforce

On October 13, Workday announced at its Rising 2026 conference in Las Vegas that it had signed a definitive agreement to acquire C1.ai, an identity platform built to govern both human employees and autonomous AI agents. Terms were not disclosed. The deal turns one of the biggest shifts in enterprise software into official strategy: the workforce now includes software, and software needs an identity department too.

The acquisition answers a problem most companies can feel but few can measure. Workday cited research showing that 95 percent of large US companies already deploy autonomous agents, while Deloitte found that only 21 percent have a mature way to govern them. Agents spin up in seconds, act across email, CRM, code repositories, finance systems, and cloud infrastructure, and they never file an IT ticket or wait for a quarterly access review. The old identity model, built around people who join, change roles, and leave, does not fit software that can be cloned a thousand times before lunch.

What C1.ai actually does

C1.ai, co-founded about six years ago by Alex Bovee and Paul Querna, built a platform that treats every worker, human or agent, as an identity with defined permissions and a complete log of every action. It connects people and agents to the systems they use, email, CRM, code repositories, cloud infrastructure, finance tools, and enforces exactly what each identity can touch, for exactly as long as needed.

The key move is tying access to the employee lifecycle already recorded in Workday. Every joiner, mover, and leaver event becomes a trigger that grants, adjusts, or revokes access automatically, instead of waiting on IT tickets and manual manager approvals. In the classic failure mode, a new hire waits a week for access to Slack, Jira, and finance dashboards, then keeps those permissions months after moving to a new department. C1.ai's pitch is that HR data, not a spreadsheet or a quarterly audit, becomes the live source of truth.

Every company now runs on a combined workforce of people and AI agents. Identity governance is what makes that workforce safe instead of just fast.

Why Workday wants it

Workday already runs the people and money systems of more than 11,500 organizations, including over 65 percent of the Fortune 500, and it has been registering AI agents in what it calls an Agent System of Record. What it lacked was the enforcement layer: governing what agents can access outside Workday and, critically, revoking that access the moment an agent's task is done. Agents are immortal by default, and an access grant that outlives its purpose is a standing invitation. C1.ai plugs that hole.

Workday CEO Aneel Bhusri framed the logic at Rising as putting HR at the center of AI security, arguing that HR is the natural source of identity because it already knows who every person is, what every agent is for, and when each of them moves or leaves. The company expects the deal to close in the fourth quarter of its fiscal 2027, which ends January 31, 2027, subject to customary closing conditions.

A headless platform and an Anthropic partnership

The acquisition headlined a broader agentic push at Rising. Workday made its Trusted Agent Platform headless, meaning agents and applications can read HR and financial data and take actions through Workday's MCP tools and SQL queries on live Workday Data Cloud, without opening the Workday interface. An Agent Harness carries the user's identity, role, and permissions into every task, and customers can choose the model behind each agent, from Claude and GPT to Llama and Mistral.

The platform also got a new face. Sana, a new agentic Workday Home experience, handles requests in natural language and orchestrates Workday's agents to resolve HR and IT issues like onboarding or password resets before they become tickets. Sana will also work inside third-party platforms, including Google Cloud's Gemini Enterprise, Microsoft Copilot, and Slack. And Workday announced a partnership with Anthropic, revealed October 12, to bring Claude's reasoning into its Sana agents and automated financial closes.

Rounding out the announcements: Autopilot Agents that run continuously across HR, finance, and IT functions like hiring, payroll, accounting, and compliance, within customer-defined policy limits; a Decision Intelligence tool that models workforce and financial scenarios; and a Skills Cloud ontology of more than 75,000 skills that maps what work can be automated or augmented.

The stakes

The strategic signal is immediate even though the deal has not closed: identity is becoming the control plane of the enterprise, the place where the speed of AI meets the accountability of the organization. Whoever decides what an agent may touch, and when it must let go, owns a critical chokepoint in how companies run.

Competitors are moving the same way. Google Cloud launched a universal Gemini agent for work days earlier at its own Gemini at Work event, and Microsoft, Salesforce, and Anthropic all spent 2026 turning workplace chatbots into agents with real permissions. Workday's bet is distinctive: that the chokepoint should sit exactly where the workforce already lives, in the HR system. If agents really are the new employees, it is a bet that looks increasingly hard to argue with.