A secure Workday AI integration starts with an approval. The architect who owns the AI vendor decision needs to defend the access model in an information security (InfoSec) review and again in an audit six months later. Defining that access model before setup means the connection holds up before anyone opens a Workday sandbox. CData Connect AI provides the governed connection layer that keeps Workday's permissions intact on every request.
What Workday AI integration means and why the Model Context Protocol is replacing custom integration builds
Workday AI integration is a governed connection that lets an AI assistant or agent read, and where approved act on, live Workday HR and finance data under the requesting user's existing Workday permissions. In 2026 it typically runs over the Model Context Protocol (MCP), an open standard that connects AI assistants and agents to tools and data through one interface. Every request carries the requesting user's identity, permissions, approvals, and audit record into Workday.
Workday's Agent-Ready Tools are MCP tools that give any MCP-capable agent an approved way to read data and take action. Workday announced general availability in Workday Extend AI on October 13, 2026, which gives agents a supported route into Workday through MCP.
Custom Representational State Transfer (REST) and Simple Object Access Protocol (SOAP) builds need per-tenant authentication, sync pipelines, and stale copies to maintain. With MCP, an agent finds approved tools through one standard interface, and Workday says Agent-Ready Tools are built specifically for LLMs, with flat schemas and clear tool descriptions. CData Connect AI adds a governed MCP layer that works alongside Workday's own tools and inherits its permissions model. For deeper background, see the Workday MCP server guide and the enterprise AI integration playbook for Workday.
Before connecting: the security and governance checklist InfoSec will ask for
Control | What InfoSec will ask | How to evidence it |
Token audience | Are tokens bound to the MCP server? | MCP servers must reject tokens not issued for them, per spec |
Tool scope | Which Workday tools can the agent call? | Read-only tools per workspace, exported as a list |
Data residency | Does any HR record leave Workday? | No storage or replication; Workday stays the system of record |
Audit logging | Can each request tie to a named user? | Audit log with user, tool, and timestamp |
Model training | Does HR data train any AI model? | Each AI vendor's data-use terms and plan settings, filed with the approval |
The MCP specification forbids token passthrough and requires separate upstream tokens. CData's OAuth and Security Assertion Markup Language (SAML) passthrough follows that rule by keeping the user's Workday identity and permissions intact, with no raw tokens forwarded.
The MCP server acts as an OAuth 2.1 resource server, the MCP client acts as an OAuth client on behalf of the resource owner, and an authorization server issues tokens, as the MCP authorization specification defines.
Every agent tool call also passes through the Workday Agent Gateway, which enforces runtime authorization, rate limiting, and policy boundaries. That adds a second enforcement layer behind any MCP platform. The checklist maps to the four functions of the National Institute of Standards and Technology (NIST) AI Risk Management Framework (Govern, Map, Measure, and Manage), so the approval files under an existing framework.
How to connect Workday to AI securely, step by step
Step 1: Connect Workday to a managed MCP platform using OAuth
Connect Workday to CData Connect AI with OAuth under a dedicated Integration System User (ISU), then confirm that requests run as the signed-in user. Limit the account to the permissions the workspace scope requires.
Step 2: Limit access with workspaces and least-privilege tools
Split headcount, attrition, and compensation into separate CData workspaces and expose read-only tools by default. In Copilot Studio, adding an MCP server makes every tool that server exposes available to the agent, so over-broad scoping carries straight into the AI client.
Step 3: Add the MCP endpoint to Claude, ChatGPT, Copilot Studio, or n8n
Step 4: Test live HR requests and review audit logs
Run three test prompts: one allowed headcount request, one compensation request that should be denied, and one cross-workspace request. Then compare the CData audit log with the user's Workday security group. As a secondary benefit, CData’s published benchmark shows pushdown through a scoped custom tool cutting Claude token usage by 97.6% on a cross-system request.
Agentic AI use case examples for Workday HR data
Agentic AI plans and carries out multistep tasks by calling tools, unlike workflow AI, which follows a fixed, predefined sequence. In Workday HR scenarios, an agentic assistant chooses which approved tools to call.
Use case | Persona | Access level | Approval risk |
Headcount Q&A | Human resource information system (HRIS) manager | Read-only, headcount workspace | Low |
Attrition trend by department | People analytics lead | Read-only, attrition workspace | Low |
Compensation band review | HRIS manager | Read-only, compensation workspace, named security group | High |
Onboarding status agent | Developer | Read-only first, approved actions later | Medium |
Workday's own example, an agent that alerts finance when a department is trending over budget, translates directly to HR. A matching agent alerts a people analytics lead when departmental attrition trends above an agreed threshold. The Workday and Connect AI use case examples show more patterns.
Workday's toolset also includes write and action tools. Keep write actions out of the first pilot and route any over-policy action to a human reviewer, as the Workday Agent Gateway does.
Troubleshooting and AI change management tips for a production rollout
Transport errors. Copilot Studio supports Streamable Hypertext Transfer Protocol (HTTP) only and rejects server-sent events (SSE), so switch the transport.
Users see empty results. Their Workday security group doesn't include the workspace data, so align the group with the workspace.
The NIST Generative AI Profile (NIST-AI-600-1) gives the rollout plan a reference for documenting risks specific to generative AI. Change management works best with one control per persona:
Security and compliance teams: Scheduled audit log reviews
Business analysts: Approved prompt libraries
Developers: A sandbox workspace
Phase the rollout with one HR workspace, one AI client, and one pilot group, then expand only after the audit review. n8n's selectable tool exposure shows how to limit tools per workflow. Developers can test first with the free Connect AI tier, Python software development kit (SDK), and command-line interface (CLI).
Get IT approval for Workday AI with CData Connect AI
CData Connect AI preserves Workday identity, stores no HR records outside Workday, and scopes access by workspace with full audit visibility, so teams can move from proof of concept to production in days, backed by SOC 2 Type II certification and 98.5% source-level accuracy as reported by CData. Workday's Agent Passport points toward verified, approved agents, and a governed MCP layer adds to that verification trail. Use the IT approval page to brief IT, and start a free trial of CData Connect AI.
Frequently asked questions
What do I need to set up before connecting Workday to an AI tool?
Workday OAuth 2.0 support, a dedicated ISU, and a defined workspace scope form the baseline. Customers on the Main Service Agreement may also need to opt in to the Universal Main Service Agreement, depending on whether the agents are Workday-built or self-built. Each AI client's plan must also support custom MCP connectors.
Can third-party AI tools like Claude, Microsoft Copilot, or ChatGPT connect to Workday?
Yes. Each connects through MCP, and a governed layer such as Connect AI applies Workday permissions to every request.
How does Workday AI integration keep sensitive HR data secure?
Every request carries the user's identity and Workday permissions. The Workday Agent Gateway enforces authorization, while workspace scoping and audit logs limit and record access.
Does connecting Workday to an AI agent require custom integration code?
No. MCP-compatible tools connect to a managed endpoint through configuration, with no custom pipelines to build or maintain.
How do AI agents respect Workday role-based permissions when querying HR data?
The agent acts as the signed-in user. OAuth passthrough preserves that identity, so each request returns only data the user's Workday security group allows.
What Workday data can an AI agent actually access and act on?
Agents fetch headcount, attrition, and compensation data from live Workday sources, limited by workspace and tool scope. Write actions stay off until a reviewer approves them.
What should an implementation team do before moving a Workday AI integration to production?
Define the use case, map permissions, and register the agent. Then run security tests, including denied-request checks and an audit log review.
