Workday-C1 changes HR-led identity governance, not entitlement drift

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Opti's blog post: Workday's planned acquisition of C1 may improve HR-led joiner-mover-leaver automation, but entitlement drift and non-HR identities still require separate governance.

Why it matters: IAM teams need to separate HR signal from access authority, because lifecycle events alone do not reveal whether permissions, service accounts or agents remain appropriate.

Context

The security gap here is not lifecycle automation itself, but the assumption that an HR event is enough to decide whether access is still right. HR systems can tell you who joined, moved or left, yet they do not tell you whether entitlements remain justified across applications, infrastructure and agents. A identity security programme has to treat that as a separate governance problem.

This distinction matters because provisioning is only the first part of identity governance. The harder control question is what happens after access is granted, especially in environments with multiple HR systems, cloud and on-prem applications, and identities that never pass through HR at all.

Key questions

Q: How should teams separate HR data from access governance?

A: Teams should keep HR records and access governance related, but not treated as the same system of record. HR data drives joiner-mover-leaver events, while IAM and PAM govern entitlements, approvals, role changes, and access reviews. Use scoped integrations, least-privilege connectors, and clear ownership so sensitive HR attributes do not become a substitute for access decisioning.

Q: How should teams govern service accounts that never pass through HR?

A: Service accounts that never pass through HR should be governed as owned machine identities with a named business or technical owner, a defined purpose, and lifecycle controls. Track where each account is used, issue only the permissions it needs, rotate secrets and certificates, and disable accounts that are no longer tied to an active workload or integration.

Q: What is the best way to review overprivileged AI agents?

A: The best way to review overprivileged AI agents is to compare their actual permissions with the task they are meant to perform, then remove unused tool, data, and system access. Review the human accountable for the agent, the approvals behind delegated authority, and any standing privileges that should become time-bound or revocable.

Technical breakdown

Why HR events are not the same as entitlement authority

HR data establishes identity context, such as employment status, role and reporting line. Entitlement authority is different: it concerns what a subject can actually do inside applications, cloud platforms and operational systems. Access decisions require peer comparison, privilege usage, and application-specific context because the same worker record can map to very different permission sets across systems. When those layers are conflated, recertification becomes a formality and post-provisioning drift goes unnoticed.

Practical implication: Separate worker lifecycle data from entitlement governance, and use access evidence rather than HR status alone to validate permissions.

Why joiner-mover-leaver automation still leaves drift behind

JML automation accelerates the moments when access should change, but it does not govern what accumulates between those events. In practice, users gather permissions over time, service accounts survive project exits, and agents can be provisioned with more scope than they need. That is why lifecycle automation reduces friction without removing privilege creep. The control gap is not speed, but the absence of continuous entitlement analysis after the initial provisioning event.

Practical implication: Use JML to trigger access changes, then pair it with continuous entitlement review to catch accumulated privilege and orphaned accounts.

How non-human identities break the HR-centred model

Service accounts, API keys and AI agents often originate outside the HRIS, so they do not inherit the employee lifecycle as a natural governance wrapper. That means their owners, purposes and termination conditions have to be managed explicitly. If the only operating model is HR-led, these identities become invisible because they are neither hire nor mover nor leaver events. The result is a governance blind spot where machine access outlives the business use case that created it. See the Agentic AI Identity Guide.

Practical implication: Register every non-human identity in a governed inventory with ownership, purpose and retirement criteria that do not depend on HR events.

NHI Mgmt Group analysis

HR-led governance is necessary, but it is not sufficient for entitlement control. HR data is the best source for employment status and organisational context, yet access risk lives in the permissions layer, not the personnel record. Once a company has multiple directories, cloud estates, external users or machine identities, a worker record cannot answer whether access is still justified. Practitioners should treat HR as an input to access governance, not the governor itself.

Privilege drift is the real control failure, not slow provisioning. Faster joiner-mover-leaver workflows solve a legitimate operational pain, but most risk emerges after access is granted. Accounts accumulate permissions across role changes, projects and exceptions, and reviewers approve them when they lack risk context. The governance failure is not that access was provisioned slowly; it is that no one continuously reassessed what remained attached to the identity.

Non-human identities expose the boundary of HR-centric identity models. Service accounts and AI agents do not have a human employment lifecycle, so their governance cannot depend on hiring, transfer or termination events. That is why a model that works for employees can leave machine identities unmanaged, especially when they are created by engineering or business teams. The practical conclusion is that identity governance must extend beyond the HRIS into a broader control plane.

Entitlement authority should be treated as a separate discipline from identity source of truth. Knowing who someone is is a data problem; knowing what they should still be able to do is a security problem. The strongest programmes keep those functions connected but distinct, so HR context informs decisions without being mistaken for approval. That separation is what keeps lifecycle automation from becoming a false sense of control.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: Identity Security Programme Guide

What this signals

Entitlement drift becomes the decisive control problem once provisioning is fast enough to hide it. HR-linked automation reduces delay, but it can also make excess access look normal unless teams keep analysing what permissions remain in use after role changes. The operative question is no longer who got access, but whether that access still maps to current need.

AI agents turn lifecycle governance into a runtime issue. When access can be created for an agent and retained long after its task changes, review cadences based on human employment events lose their timing advantage. Governance has to move closer to issuance and revocation, because the identity may exist entirely outside the HR system.

For practitioners

• Separate HR truth from access authority Use HR records to seed lifecycle events, but require entitlement evidence from the target systems before approving or retaining access.
• Continuously review post-provisioning privilege Focus reviews on the access that changes slowly, accumulates silently or no longer matches current job need, rather than relying on hire and leave events alone.
• Inventory non-human identities outside HR Track service accounts, API keys and AI agents in a governed register with an owner, business purpose and retirement date.
• Prioritise high-risk access before broad recertification Sort reviews by privilege level, business sensitivity and recent usage so approvers spend time on the access most likely to matter.
• Define offboarding for identities that never touch HR Create a retirement path for machine identities that can be revoked when the project, integration or agent purpose ends.

Key takeaways

• HR systems improve identity context, but they do not by themselves prove whether access remains appropriate across applications and agents.
• The main governance failure is privilege accumulation after provisioning, especially where users change roles or machine identities outlive their original purpose.
• Identity programmes need a separate access authority layer so lifecycle automation does not become a substitute for entitlement review.

Related NHI Mgmt Group resources: Identity Security Programme Guide · AI Agent Authorisation Guide · Agentic AI Identity Guide · Agentic AI Identity Maturity Model

Key terms

• Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
• Entitlement Governance: Entitlement governance is the discipline of deciding who or what should have access, for how long, and under what business justification. It spans human users, non-human identities, and automated workflows, making it a core control layer for SaaS, cloud infrastructure, and lifecycle management.
• Privilege Drift: Privilege drift is the gradual gap between the permissions an identity was meant to have and the permissions it actually retains. In AI agent environments, drift grows quickly because roles are reused, tasks change, and lifecycle reviews often lag behind deployment velocity.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.