Workday has made components of its platform generally available to external agents, allowing developers to build HR and finance agents within Claude Code, Cursor, and other tools while keeping the agent subject to the user’s permissions, approvals, and Workday audit record.
The company announced this during the Workday Rising conference in Las Vegas, explaining that the Model Context Protocol (MCP) server, access to live Workday data through SQL, and the shared agent runtime are now generally available. Customers can run their agents using models from Anthropic, Google, Meta, Mistral, Nvidia, and OpenAI.
Direct Access with the Same Permissions
The Agent-Ready Tools component is the main entry point for developers. It is the MCP server provided through Workday Extend AI. Users log in with their Workday credentials, and the company says the agent cannot access data beyond what that user is entitled to see.
The server currently includes 275 read tools and 54 tools for adding or deleting data. The Live Data Query service, part of Workday Data Cloud, also allows business intelligence tools and agents to execute SQL queries directly against Workday data, with each query returning only the records that the user’s permissions allow them to access.
Workday also provides Agent Harness, a shared runtime that passes the user’s identity, organizational position, and access rights to the agent and determines what it can execute. It also selects the appropriate model for each task based on cost and performance. Developer Agent creates Workday agents and applications from natural-language commands within Claude Code, Codex, Cursor, or the Workday Developer site.
Custom Agents allows teams to deploy agents built using LangChain or the Google Agent Development Kit on Agent Harness, but ADK support is currently limited to design partners.
What Changes in Practice?
Workday says customers created more than 500 agents and more than 6,000 applications using Developer Agent and Agent-Ready Tools during the previous four months. The company is preparing to make Agent Context Service and Grounded Reasoning available in an early-access release in early 2027. The former will load only the data required for the task, while the latter will review the proposed action against the customer’s policies, business rules, and Workday records before execution.
The essence of the announcement is moving the agent from a model based on copying data to one that connects to the original system of record and its rules. Workday demonstrated an example of an agent connected to a custom MCP server and a data copy in Snowflake, where it was able to access unauthorized job applications and display the chief technology officer’s salary. When using the Workday server and Data Cloud with the user logged in, the results were limited to authorized data.
Approach Limitations and Identity Questions
Workday does not believe that data lakes have lost their value; they remain suitable for analytics and for integrating company data. However, CTO Gabe Monroy said that exporting data does not transfer the rules governing it, which may require rebuilding a second security model inside the lake and could cause it to diverge from the original system.
In contrast, Gerrit Kazmaier, head of product and technology, explained that building agents directly on Workday tools and MCP interfaces suits a small set of use cases that do not require HR or finance logic. In other cases, Workday expects a flow in which Claude passes the request to Sana, its agent orchestrator, which invokes specialized Workday agents.
This point reveals that open availability does not necessarily mean that agents operate independently of the Workday environment. The agent’s identity also remains an important design issue. The company’s documentation indicates that two system accounts can be used for the agent: one to act on behalf of the user and the other for surrounding tasks, with each having a separate OAuth 2.0 client and separate permissions.