Topic starter
06/11/2026 6:35 pm
TL;DR: Workday's planned acquisition of C1 strengthens HR-led lifecycle governance for hires, moves and leavers, and is a sensible fit for some mid-market environments, but it does not solve entitlement drift, orphaned service accounts or overprivileged AI agents, according to Opti's analysis. The real boundary is between knowing who someone is and proving whether their access remains appropriate.
Editorial analysis by NHI Mgmt Group, based on content published by Opti: “What Workday buying C1 means for your identity program”.
Key questions
Q: How should teams separate HR data from access governance?
A: Teams should keep HR records and access governance related, but not treated as the same system of record.
Q: How should teams govern service accounts that never pass through HR?
A: Service accounts that never pass through HR should be governed as owned machine identities with a named business or technical owner, a defined purpose, and lifecycle controls.
Q: What is the best way to review overprivileged AI agents?
A: The best way to review overprivileged AI agents is to compare their actual permissions with the task they are meant to perform, then remove unused tool, data, and system access.
Practitioner guidance
- Separate HR truth from access authority Use HR records to seed lifecycle events, but require entitlement evidence from the target systems before approving or retaining access.
- Continuously review post-provisioning privilege Focus reviews on the access that changes slowly, accumulates silently or no longer matches current job need, rather than relying on hire and leave events alone.
- Inventory non-human identities outside HR Track service accounts, API keys and AI agents in a governed register with an owner, business purpose and retirement date.
Bottom line: HR systems improve identity context, but they do not by themselves prove whether access remains appropriate across applications and agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
HR-led governance is necessary, but it is not sufficient for entitlement control. HR data is the best source for employment status and organisational context, yet access risk lives in the permissions layer, not the personnel record. Once a company has multiple directories, cloud estates, external users or machine identities, a worker record cannot answer whether access is still justified. Practitioners should treat HR as an input to access governance, not the governor itself.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the best way to review overprivileged AI agents?
A: The best way to review overprivileged AI agents is to compare their actual permissions with the task they are meant to perform, then remove unused tool, data, and system access. Review the human accountable for the agent, the approvals behind delegated authority, and any standing privileges that should become time-bound or revocable.
👉 Read our full editorial: Workday-C1 changes HR-led identity governance, not entitlement drift