On October 13, 2026, at its Rising conference in Las Vegas, Workday announced a definitive agreement to acquire C1.ai, which it calls a leading agentic identity platform for people and agents. The pitch, in one line from the announcement: C1.ai connects to the systems a business runs on, from email and CRM to code repositories, finance systems, and cloud infrastructure, so that each person and each AI agent gets the right access at the right time, and loses it the moment it is no longer needed.
Two data points in the same release explain why Workday is buying now, and they deserve attention from businesses of every size:
- C1.ai's research shows that 95% of large U.S. companies already run autonomous agents.
- According to Deloitte's State of AI research cited by Workday, only 21% report having a mature way to govern them.
Ninety-five percent are running. Twenty-one percent are governing. That gap is where almost every agent-related horror story of the past two years fits, and identity is the discipline Workday is betting on to close it.
The problem C1.ai was built to solve
Most organizations still manage employee access across hundreds of applications with manual service tickets, spreadsheets, and periodic reviews as workers join, move, and leave. Workday's announcement describes employees whose access quietly outlasts their role, and the arrival of autonomous agents accelerates the same problem at machine pace: an agent hired for one task keeps its credentials forever, nobody can say why it has access, and the compliance review happens once a year if at all.
Workday's framing has an elegant core: every new hire, job change, and exit is a Workday event. If the HR system of record knows when a role starts and ends, it can become the authority for what that role, human or machine, is allowed to touch. As Workday puts it, with C1.ai, Workday can give every person and AI agent the right access from the day they join to the day they leave, and everywhere in between.
This mirrors what we saw in SailPoint's data on the 40x identity gap: 79% of organizations already run AI agents in production while only 2% can govern agent identities up to standard. The identity industry has been saying this all quarter, and now the largest HR platform has put acquisition money behind it.
The scale of the trust problem
Rushing agents into production without identity controls creates security and compliance risks across the business, as Workday's release puts it plainly: without controls, AI agents can become lawless. The pattern shows up across the coverage we have published this month:
| Signal | Source and date |
|---|---|
| 95% of large U.S. companies already run autonomous agents | C1.ai research, cited by Workday, Oct 13, 2026 |
| Only 21% report a mature way to govern AI | Deloitte State of AI, cited by Workday, Oct 13, 2026 |
| 79% of organizations run agents in production, only 2% secured to standard | SailPoint study, Oct 10, 2026 |
| 74% of finance teams use AI, 14% see enterprise value | OneStream CFO Index, Oct 14, 2026 |
Adoption is ahead of governance in every survey, on every continent, in every function. Identity is the control plane the market is converging on, whether it arrives through an HR system or a security vendor.
What else came out of Rising
The C1.ai deal was not the only agentic announcement at the conference. Coverage of Workday Rising also reported:
- Sana becomes the new Workday Home, positioning the acquired AI assistant as the main experience surface over HR and finance data.
- Autopilot agents announced for talent acquisition, payroll, and accounting, handling routine work in those functions.
- A partnership with Anthropic to bring its models into Workday's agentic architecture.
Each of those capabilities raises the same question the acquisition answers: when an autopilot payroll agent needs write access to your payroll system, who granted it, who reviews it, and when does it expire? Agent capability is only as trustworthy as the identity layer underneath it, which is ServiceNow's argument with AI Passport as much as Workday's with C1.ai.
What SMBs should copy from the deal
A small business will not acquire an identity platform, and it does not need one to get the pattern right. The Workday-C1.ai design, reduced to its essentials:
- One inventory. Every agent, human or machine, that has access to your systems is written down in one place. If you cannot list your agents today, start with a two-hour shadow-agent audit, the way we described in our shadow AI agents piece.
- Access follows roles, not requests. Grant what the role needs, revoke when the role changes or ends. Same rule for an offboarding sequence and a decommissioned workflow bot.
- Every agent has a human owner. An identity without an accountable owner is a liability with credentials.
- Lifecycle enforcement beats annual review. C1.ai's own value proposition is that removal happens automatically when access is no longer needed. You can approximate that at small scale with monthly expiring credentials.
- Log what each identity does. When an agent misbehaves, the log is the difference between an incident and an investigation.
The boards buying C1.ai-class identity for their enterprises are solving the same problem a five-person agency solves with a spreadsheet and a monthly ritual. The principle is identical, only the tooling differs.
