On 13 October 2026, at its Workday Rising 2026 event in Las Vegas, Workday, Inc. announced a definitive agreement to acquire C1.ai — the identity platform formerly known as ConductorOne — which it describes as “a leading agentic identity platform for people and agents”.
What happened
C1.ai “connects to the systems a business runs on — from email and CRM to code repositories, finance systems, and cloud infrastructure — giving each person and agent the right access at the right time and removing it the moment it’s no longer needed”, according to the announcement. Workday frames the acquisition as moving from registering agents to governing what they can access.
The stated gap is a KYA one. Workday cites C1.ai’s own research that 95% of large U.S. companies already run autonomous agents, alongside Deloitte’s State of AI 2026 finding that only 21% report a mature way to govern them. As Workday puts it, organizations must “know who and what has access, why they have it, and when to remove it” — and without those controls, “AI agents can become lawless”.
The mechanics are the interesting part for agent identity:
- The Agent System of Record (ASOR) already gives Workday customers “one place to see and manage their agents”. C1.ai is to build on it so an agent “can receive the access it needs, when it needs it, and lose that access immediately when its work or role ends”.
- Differentiating delegated from autonomous agents. The release distinguishes agents that “act on behalf of an employee and should only reach part of what that person can” from agents that “work on their own with broader access that needs close oversight” — including “an agent that was retired last quarter [that] shouldn’t still be able to get in”.
- Identity governance for people and agents in one layer, tied to HR lifecycle events (join, role change, exit), which Workday already owns.
> “Today’s companies run on a combined workforce of people and AI agents. With C1.ai, we’ll help secure that workforce by managing and enforcing exactly who — and what — has access to connected apps and systems.” — Gerrit Kazmaier, president, product and technology, Workday
> “Enterprises can’t secure the AI era using yesterday’s IT tickets.” — Alex Bovee, CEO and co-founder, C1.ai
Deal terms. The transaction is expected to close in the fourth quarter of Workday’s fiscal year 2027, ending 31 January 2027, subject to customary closing conditions. BofA Securities and Orrick advised Workday; Qatalyst and Ashurst Perkins Coie advised C1.ai.
Why it matters for KYA
This is a governance-and-revocation story more than a marketing one. Most KYA attention goes to proving who an agent is; the harder, less glamorous half is limiting what it may reach and taking that access away on time. Workday is buying exactly that capability and bolting it onto an agent registry it already runs.
Three things are worth noting for anyone designing a KYA control:
- Registration is not governance. ASOR already answered “what agents do we have?”. The acquisition targets the next question — “what is each one allowed to access, and has that changed?”. That is the transition from an agent inventory to an agent entitlement model, and it is where real audits bite.
- Delegated vs. autonomous agents need different scopes. The release explicitly separates agents acting on behalf of a person (scoped to a subset of that person’s access) from autonomous agents with broader standing access. Getting that distinction wrong is the classic confused-deputy failure mode.
- Lifecycle-bound revocation. Tying agent access to HR events (join, move, leave) is a concrete, testable revocation trigger — closer to a real control than a policy promise that “access can be revoked”.
The caveat is proportion. This is an announced acquisition, not a shipped product or a standard: it is forward-looking, subject to closing, and the combined capability does not exist yet. It also governs only the systems C1.ai actually connects to — access it cannot see, it cannot revoke. Treat it as a marker of where enterprise agent governance is heading, not as a control you can deploy today.
Sources
- Workday, Inc. press release (13 October 2026), “Workday to Acquire C1.ai, a Leading Agentic Identity Platform for People and Agents” — prnewswire.com and investor.workday.com.
- Workday, Inc. Form 8-K (13 October 2026), exhibit 99.1 “Press release … dated October 13, 2026” — stocktitan.net.
- C1.ai (formerly ConductorOne) — Future of Identity & Security 2026 research and company description — c1.ai.
- Deloitte, State of AI 2026 — governance-maturity figure cited in the Workday release — deloitte.com.
- Analyst quotes and lifecycle/agent-governance details are from the Workday press release above; trade coverage such as Unite.AI, “Workday Signs Deal to Acquire Agentic Identity Platform C1.ai” (13 October 2026) — unite.ai.
Note: the acquisition was announced, not closed. Capabilities described as resulting from the combination are subject to the transaction closing and to Workday’s product timelines, and should not be treated as available today.
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.