Workday is now letting developers build their own HR and finance agents that can run in Claude Code, Cursor, and other tools, as long as those agents operate under the same permission rules as the people who use them. The company announced at its Workday Rising conference in Las Vegas on Tuesday that its Trusted Agent Platform is now "headless," meaning its Model Context Protocol (MCP) server, SQL access to live Workday data, and a shared runtime for agents are generally available. Customers can now run their own agents on models from Anthropic, Google, Meta, Mistral, Nvidia, and OpenAI.
The platform's main entry point for AI developers is Agent-Ready Tools, Workday's MCP server that ships as part of Workday Extend AI. Users sign in with their own Workday credentials, and an agent acting for them can't reach anything their own account can't access. The server currently offers 275 read tools and 54 tools that write or delete data. Live Data Query, part of Workday Data Cloud, lets BI tools and agents run SQL queries directly against Workday's data, with each query returning only what the requesting user is cleared to see. Three more components are generally available today: Agent Harness, a shared runtime that passes each agent the user's identity, org position, and access rights; Developer Agent, which generates Workday agents and apps from a natural-language prompt; and Custom Agents, which lets teams deploy agents they built with LangChain or Google's Agent Development Kit onto Agent Harness. Two more pieces are on the roadmap for early access in early 2027: Agent Context Service, which will preload only the Workday data a task calls for, and Grounded Reasoning, which will check a planned action against the customer's policies and process rules before the agent carries it out. Workday says customers have built more than 500 agents and more than 6,000 apps with Developer Agent and Agent-Ready Tools in the past four months.
Workday CTO Gabe Monroy said "no matter who builds the agent, it runs under Workday permissions, approvals and audit trail — no agent gets a side door." The company notes that many companies currently connect their agents to HR and finance data through copies in a data lake or through service accounts, but those approaches bypass access controls. In a demo, Monroy showed an agent connected to a custom MCP server returning job requisitions its user had no business seeing, then moving the wrong employee between teams with no approval. When pointed at a copy of Workday data in Snowflake, the same agent produced the CTO's salary when asked. "When it fails, it isn't just a wrong answer," Monroy said, "it's a wrong action that nobody approved." When the agent went through Workday's own MCP server and Data Cloud instead, with the user signed in, the same queries returned only the requisitions that user was allowed to see.
The headless approach is becoming standard across enterprise software platforms. Salesforce, ServiceNow, and Microsoft already let outside agents into their systems of record, with Salesforce launching Headless 360 in April and ServiceNow making its Action Fabric MCP server generally available in May. All four vendors say outside agents stay within their existing permission models. But vendors are taking very different approaches to agent identity. Salesforce is preparing to have agents that connect over MCP or its APIs register with their own credentials and permissions instead of acting under a user's identity, while Workday's agents can already get up to two system accounts of their own, called Agent System Users. Monroy said data lakes still make sense for analytics and for joining Workday data with the rest of a company's data, but that an external lake is "the wrong place to build agents" that need governed access to Workday. According to Workday's president of product and technology Gerrit Kazmaier, building agents directly on Workday's tools and APIs is "only possible for a small set of use cases where you don't need to have HR or finance domain logic." For everything else, he pointed to an AI-to-AI integration in which Claude hands requests to Sana, Workday's agent orchestrator, which then calls Workday's own domain agents. The platform's architecture ensures that even when customers choose headless access, Workday's runtime remains in the middle of every call. As enterprises race to deploy AI agents that touch sensitive employee and financial records, the pressure to prove those agents respect existing access boundaries will only intensify. The trade-off between developer flexibility and central governance may ultimately define which platforms win the agent economy.