Workday agreed to acquire C1.ai, adding identity governance intended to manage what employees and AI agents can access across business systems.
Workday has signed a definitive agreement to acquire C1.ai, a company that manages identity and access across enterprise applications for people and AI agents. Announced October 13 at Workday Rising, the proposed deal would extend Workday’s HR, finance and IT platform into governing access to systems including email, customer relationship management tools, code repositories, financial software and cloud infrastructure.
The companies frame the acquisition around a problem created by rapidly growing agent deployments: permissions often remain distributed across manual service tickets, spreadsheets and periodic reviews. Workday says C1.ai can grant access when a person or agent needs it and remove it when a role or task ends. For agents, this could mean limiting an assistant acting for an employee to only the resources it requires, monitoring independently operating agents, and revoking access from systems no longer in use.
Workday says the acquisition would build on its Agent System of Record, which provides a place for organizations to register and manage agents. The intended expansion is from tracking which agents exist to governing the applications and data they can reach, including outside Workday. That scope is strategically significant for businesses weighing broader automation against risks from excessive privileges, forgotten agent accounts and weak audit trails.
The proposed transaction is subject to customary closing conditions. Workday expects it to close in the fourth quarter of its fiscal 2027, which ends January 31, 2027. The announcement did not disclose a purchase price. Until closing and product integration, the proposed combined capabilities should be understood as planned rather than as a fully available unified service. The deal reflects a growing enterprise software focus on identity controls as AI agents become another category of workplace actor requiring permissions, oversight and timely deprovisioning.