Workday goes headless, opening its HR and finance data to outside AI agents
The New Stack Frederic Lardinois
Workday made its HR and finance platform open to outside AI agents. The catch: those agents still have to obey Workday’s permissions and audit trail.
Based on reporting by The New Stack, Frederic Lardinois — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Workday is letting outside AI agents into the room, but only on its terms. At Workday Rising in Las Vegas on Tuesday, the company said its Trusted Agent Platform is now “headless,” which means developers can build HR and finance agents in tools like Claude Code and Cursor while still running them through Workday’s rules.
The practical pieces are now generally available: an MCP server, SQL access to live Workday data, and a shared runtime for agents. Workday says customers can run their own agents on models from Anthropic, Google, Meta, Mistral, Nvidia, and OpenAI. Gabe Monroy, Workday’s CTO, put the pitch bluntly: no matter who builds the agent, it stays under Workday permissions, approvals, and audit trail.
That matters because Workday thinks a lot of agent setups today cut corners. The company says many teams connect agents to HR and finance data through copies in a data lake or through service accounts, which can sidestep access controls. Its answer is to tie the agent directly to the user’s own Workday credentials. Through Agent-Ready Tools, Workday’s MCP server inside Workday Extend AI, an agent can’t see more than the user can. Monroy said it currently exposes 275 read tools and 54 tools that write or delete data.
Workday’s Live Data Query, part of Workday Data Cloud, gives BI tools and agents SQL access to Workday’s object graph. The company says each query only returns what the requesting user is cleared to see. Agent Harness then acts as the shared runtime, passing along identity, org position, and access rights, limiting what the agent can do, and choosing which model handles each task based on cost and performance. Workday also showed Developer Agent, which can generate agents and apps from prompts in Claude Code, Codex, Cursor, or the Workday Developer Site, plus Custom Agents for deployments built with LangChain or Google’s Agent Development Kit.
The company is also planning two more pieces for early access in early 2027: Agent Context Service, which would preload only the Workday data a task needs, and Grounded Reasoning, which would check an action against customer policy before it happens. Workday says customers have already built more than 500 agents and more than 6,000 apps with Developer Agent and Agent-Ready Tools over the past four months. Monroy’s demo was designed to show why the guardrails matter: pointed at a custom MCP server or a copy of Workday data in Snowflake, the agent could see job requisitions it shouldn’t and even return the CTO’s salary. Through Workday’s own stack, the same queries stayed inside the rules.
My take — AI-written commentary, not fact-checked reporting
This is the right instinct: if an agent can move people around or read salaries, “trust me” isn’t a security model. Workday is basically saying the copy-paste data-lake era is fine for analytics, but not for live decisions that can embarrass a company in five seconds flat. Sensible, finally.}
Read more about this at: The New Stack