Workday Opens Trusted Agent Platform with MCP Server and Live Data Access

Platform goes headless

Workday made its Trusted Agent Platform "headless" at its Workday Rising conference in Las Vegas on Tuesday, generally releasing its Model Context Protocol (MCP) server, SQL access to live Workday data, and a shared runtime for agents. Customers can now build and run their own HR and finance agents in tools like Claude Code and Cursor, on models from Anthropic, Google, Meta, Mistral, Nvidia, and OpenAI. CTO Gabe Monroy said every agent runs under Workday's existing permissions, approvals, and audit trail, with no side door around access controls.

Tools for developers

The main entry point is Agent-Ready Tools, the MCP server shipping with Workday Extend AI. Users sign in with their own Workday credentials, so an agent can only reach what that user's account allows. The server currently offers 275 read tools and 54 tools that write or delete data. Live Data Query, part of Workday Data Cloud, lets BI tools and agents run SQL directly against Workday data, returning only what the requesting user is cleared to see. Agent Harness, the shared runtime now generally available, passes each agent the user's identity, org position, and access rights, limits its actions, and routes tasks between models based on cost and performance.

Workday says customers have built more than 500 agents and over 6,000 apps using Developer Agent and Agent-Ready Tools in the past four months. Two more components are slated for early access in early 2027: Agent Context Service, which preloads only the data a task requires, and Grounded Reasoning, which checks planned actions against customer policies and Workday records before execution.

Why not data lakes?

Monroy demonstrated an agent connected to a custom MCP server returning job requisitions the user had no right to see and moving the wrong employee between teams without approval. The same agent, pointed at a Workday data copy in Snowflake, revealed the CTO's salary. Workday argues that connecting agents through data lake copies or service accounts bypasses access controls, whereas its approach ties agents to signed-in user identities. Monroy acknowledged data lakes still make sense for analytics and joining Workday data with other systems, but called them the wrong place for governed agents, since exporting data means maintaining a second copy of Workday's security model.

Headless race

Salesforce, ServiceNow, and Microsoft already let outside agents into their systems of record, with Salesforce launching Headless 360 in April, ServiceNow shipping its Action Fabric MCP server in May, and Microsoft offering an MCP server for Dynamics 365 ERP. Workday's president of product and technology, Gerrit Kazmaier, said building directly on its tools and APIs works for a small set of use cases, and pointed to an AI-to-AI path in which Claude hands requests to Sana, Workday's agent orchestrator, which then calls Workday's own domain agents.

Sources: Thenewstack