Why Is Workday Buying an Agentic Identity Startup? What C1.ai Means for Your AI Stack

Last Updated: October 14, 2026

On October 13, 2026, Workday announced a definitive agreement to acquire C1.ai, which it describes as an agentic identity platform for people and AI agents. The deal puts AI agents into the same access governance that already covers employees. For businesses, the question is no longer whether agents need identity controls, but who owns them, what they can reach, and when their access ends.

What Workday announced

According to Workday's own press release, the company signed a definitive agreement to acquire C1.ai at Workday Rising 2026 in Las Vegas on October 13. Workday describes C1.ai as a leading agentic identity platform, and says the goal is to give every person and AI agent the right access from the day they join to the day they leave.

Workday's framing is that it will become the identity governance layer for people, money, and agents. The same announcement launched a wave of AI agents for HR, payroll, and finance applications.

Why agent identity is becoming a category

Agents act. They read records, call tools, and sometimes change data. Once an agent can do that, it needs the same controls a human employee has: a defined role, limited access, an owner, and a way to remove access. Traditional identity systems were built for people, and most were not designed to answer "which agent just ran this query, on whose behalf, and does it still need access?"

That is why the Workday deal reads as a category signal rather than a one-off. Enterprise software vendors are moving to bring agents under the same governance as staff, instead of treating them as scripts with API keys.

What this means for mid-market buyers

You do not need an enterprise identity platform to start. The controls that matter map onto a small set of questions you can answer this week.

• Who owns each agent? Every agent needs a named human owner who is accountable for what it does.
• What can it reach? Scope each agent to the specific systems and records it needs, and nothing else.
• When does its access end? Give every agent an expiry date, and review it when the project changes.
• Can you see what it did? Keep logs of agent actions so you can answer questions after the fact.
• Can you switch it off? Know how to revoke an agent's access quickly, without breaking unrelated work.

Where to start in Australia

Australian businesses handling personal information have to think about where data goes and who can access it. An agent that reads customer records and sends them to a hosted model is a data handling decision, not just a software purchase. Writing down agent owners, scopes, and log retention is a sensible first step whatever platform you use.

Frequently asked questions

What is agentic identity?

Agentic identity is the practice of giving AI agents their own managed identities, with defined permissions, owners, and lifecycle controls, in the same way companies manage employee access.

What did Workday announce about C1.ai?

On October 13, 2026, Workday announced a definitive agreement to acquire C1.ai, an agentic identity platform for people and AI agents, at Workday Rising 2026.

Do small businesses need an agentic identity platform?

Not to start. A named owner, scoped access, expiry dates, logs, and a kill switch cover most of the risk for a small team, and they can be done with existing tools.

How is an AI agent's identity different from a user's?

An agent acts at machine speed and often chains several tools, so its permissions and logs need to be narrower and easier to audit than a typical employee's account.