At its Workday Rising conference in Las Vegas on Tuesday, the company announced that its Trusted Agent Platform is now operating in headless mode. The Model Context Protocol (MCP) server, direct SQL access to live Workday data, and a shared runtime for agents have all reached general availability. Customers can now deploy agents built on models from Anthropic, Google, Meta, Mistral, Nvidia, and OpenAI.
The shift addresses a security concern that Workday identifies in how many enterprises currently integrate agents with HR and finance systems. Today, companies often connect agents to this data through copies stored in data lakes or by using service accounts—approaches that Workday contends bypass proper access controls. The new architecture ensures that agents inherit the same permissions, approvals, and audit trails as the users they represent.
Workday CTO Gabe Monroy explained the philosophy behind the design: "No matter who builds the agent, it runs under Workday permissions, approvals and audit trail — no agent gets a side door."
Core components now available
Agent-Ready Tools, Workday's MCP server bundled with Workday Extend AI, serves as the primary interface for AI developers. Users authenticate with their own Workday credentials, and agents acting on their behalf cannot access anything beyond what that user's account permits. The server currently exposes 275 read tools and 54 tools capable of writing or deleting data.
Live Data Query, part of Workday Data Cloud, enables BI tools and agents to run SQL queries directly against Workday's data. Monroy characterized this as JDBC access to Workday's object graph, with each query returning only data the requesting user is authorized to view.
Three additional components reached general availability alongside the MCP server. Agent Harness provides the shared runtime where Workday's own agents and those built by customers and partners execute. It passes each agent the user's identity, organizational position, and access rights; constrains what the agent can perform; and selects which model handles each task based on cost and performance considerations. Developer Agent generates Workday agents and applications from natural-language prompts in Claude Code, Codex, Cursor, or the Workday Developer Site. Custom Agents allows teams to deploy agents they built using LangChain or Google's Agent Development Kit (ADK) onto Agent Harness, though ADK support remains limited to design partners at this time.
Two additional capabilities are planned for early access in early 2027. Agent Context Service will preload only the Workday data required for a specific task, which Workday says accelerates agent performance and restricts exposure to sensitive information. Grounded Reasoning will validate a planned action against the customer's policies, process rules, and Workday records before the agent executes it.
Workday reports that customers have created more than 500 agents and over 6,000 applications using Developer Agent and Agent-Ready Tools within the past four months.
Demonstrating the risks of unsecured approaches
During the briefing, Monroy demonstrated what he termed "headless, the lawless way"—an agent connected to a custom MCP server, a configuration Workday frequently encounters among its customer base. The agent retrieved job requisitions that its user had no authorization to access and subsequently moved an employee between teams without any approval. When pointed at Workday data copied into Snowflake, the same agent produced the CTO's salary information when requested.
Monroy emphasized the stakes: "When it fails, it isn't just a wrong answer, it's a wrong action that nobody approved."
When the agent instead operated through Workday's MCP server and Data Cloud with the user authenticated, the identical queries returned only the requisitions that user was permitted to access—demonstrating how Workday's permission model prevents unauthorized data exposure and actions.
Headless adoption across enterprise software
Workday is not alone in pursuing this direction. Salesforce, ServiceNow, and Microsoft have already enabled external agents to interact with their systems of record. Salesforce introduced Headless 360 at its TDX developer conference in April, permitting agents in Claude, ChatGPT, Cursor, or a terminal to work with Salesforce data. ServiceNow made its Action Fabric MCP server generally available in May, with Anthropic as a launch partner. Microsoft provides an MCP server for Dynamics 365 ERP. All four vendors maintain that outside agents operate within their existing permission models.
Competing approaches to agent identity
Vendors are currently adopting different strategies regarding how agents establish their identity within systems. Salesforce is preparing to allow agents connecting over MCP or its APIs to register with their own credentials and permissions rather than acting under a user's identity, according to Salesforce Ben. MCP clients will eventually need to transition to OAuth credentials tied to those agent identities.
Workday's documentation indicates that its agents can already obtain up to two system accounts of their own, termed Agent System Users (ASUs)—one for acting on a user's behalf and one for "ambient" work, each with its own OAuth 2.0 client. Workday automatically creates the ambient account when a customer enables an ambient skill.
Unified.to, which sells a Workday MCP integration, notes that every Workday MCP path, "official or not," begins with creating an Integration System User (ISU). Cequence's setup guide for its Workday MCP integration instructs customers to create one "with appropriate security groups." An agent operating through an ISU sees whatever those security groups permit, regardless of who is prompting it.
Workday's vision for headless use cases
When asked whether headless matters as much to Workday as it does to Salesforce, Gerrit Kazmaier, Workday's president of product and technology, stated that Workday is offering customers a choice: "I'd always prefer if they use our user interface, but headless will be equally good."
Kazmaier cautioned that building agents directly on Workday's tools and APIs is "only possible for a small set of use cases where you don't need to have HR or finance domain logic." For other scenarios, he pointed to an AI-to-AI integration in which Claude forwards requests to Sana, Workday's agent orchestrator, which then invokes Workday's own domain agents.
Monroy emphasized that data lakes remain appropriate for analytics and for combining Workday data with other enterprise data, but that an external lake is "the wrong place to build agents" requiring governed access to Workday. He noted that while organizations can export their data, they cannot export the rules governing that data. Rebuilding those rules in the lake requires "maintaining a second copy" of Workday's security model, and "the day it drifts, it's all wrong."
The Snowflake example carries particular significance given Workday's recent data integration announcements. When Workday announced Data Cloud in September 2025, the offering included zero-copy sharing of Workday data with Databricks, Salesforce, and Snowflake. Snowflake made its Workday Data Cloud integration generally available on October 7, and Databricks released its Workday connector for Unity Catalog into public beta a day later. According to Databricks, a Workday admin configures the connector by registering an Integration System User with read access to the shared tables, after which Unity Catalog permissions at the catalog, schema, and table level determine who can query the data.