Topic starter
14/10/2026 3:49 pm
TL;DR: C1.ai says its acquisition by Workday reflects a shift to enterprises where people and AI agents share the workforce, and where identity governance must govern access continuously rather than by quarterly review or ticket flow. That makes the access model itself the control plane, not an administrative afterthought.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “C1.ai to join Workday”.
Key questions
Q: How should security teams govern access when AI agents and humans share the same apps?
A: Treat AI agents as separate identity subjects with their own approvals, scope limits, and monitoring.
Q: Why do periodic access reviews fail for agentic identity programs?
A: Because access reviews assume privilege persists long enough to be certified.
Q: What breaks when AI agents inherit human IAM controls?
A: Human IAM controls break because they assume a person makes a request, waits, and can later be reviewed or deprovisioned.
Practitioner guidance
- Define separate lifecycle rules for agents Map agent creation, activation, scope change, suspension, and shutdown to explicit governance states instead of reusing human joiner-mover-leaver logic unchanged.
- Move access decisions to issuance time Replace quarterly review dependency with policy checks at the moment access is granted or expanded, especially for agents that can act autonomously across systems.
- Inventory agent-facing entitlements Create a complete map of which agents can reach email, CRM, code repositories, finance systems, and cloud infrastructure, then tie each entitlement to an owner.
Bottom line: The announcement reflects a governance shift where AI agents are treated as first-class identities rather than exceptions hidden inside automation stacks.
What's in the full announcement
C1.ai's full post covers the operational detail this analysis intentionally leaves for the source:
- The acquisition context and how the company describes its next operating model inside Workday
- Direct wording on the Workday Agent System of Record and the governance role it plays
- The company's own positioning on governing people and agents across enterprise systems
- The forward-looking mission statement and customer-facing messaging that this post does not reproduce
👉 Read C1.ai's announcement about joining Workday and agentic identity governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/10/2026 3:50 pm
Identity governance is becoming the control plane for agentic work, not a downstream compliance function. The announcement reflects a broader market shift in which access decisions must be made at the point of action, not only at onboarding or quarterly review. When agents can operate continuously across email, finance, code, and cloud, the governance model that matters is the one that can follow runtime behaviour. Practitioners should treat this as a signal to re-centre IAM and IGA around execution-time authority.
A question worth separating out:
Q: How do organisations know if agent governance is actually working?
A: Agent governance is working when every agent is discoverable, owned, least privileged, and auditable at the action level. Look for reduced shadow AI, fewer embedded secrets, clean revocation on retirement, and logs that show which tools and data paths were used. If those signals are missing, governance is still partial.
👉 Read our full editorial: Workday acquires C1.ai: implications for agentic identity governance