Workday goes headless: MCP agents GA, permissions ride along

Workday just made its HR and finance system headless for AI agents. At Workday Rising in Las Vegas today, the company put its MCP tools, live SQL access, and agent runtime into general availability. An agent you build in Claude Code, Codex, or Cursor can now read Workday data and take actions in it. The interesting part is not the access. It is where the rules live: inside Workday, attached to every request, not in your agent's prompt.

What actually happened

Per Workday's announcement, these are generally available as of October 13:

Agent-Ready Tools, Workday's Model Context Protocol tools. Any MCP-compatible agent can read Workday data and act on it.
Live Data Query in Workday Data Cloud. Users and agents run SQL against live Workday data.
Agent Harness, the runtime for every agent, whether Workday, a partner, or the customer built it. It supplies context (who is asking, their role, reporting line, permissions) and routes tasks to models.
Custom Agents and Developer Agent in Workday Extend AI, plus LangChain support.

Supported models include Claude, Gemini, Llama, Mistral, GPT, and newly added NVIDIA Nemotron. Supported coding tools named: Claude Code, Codex, and Cursor.

Not shipped yet: Grounded Reasoning, which checks a request against company policy before the agent acts, is slated for early access in early 2027. The Agent Context Service date is inconsistent in the release itself (late 2026 in one place, early 2027 in another). Google ADK support is still at the design-partner stage. The release names no pricing.

CTO Gabe Monroy's line: "Headless can't mean lawless." The New Stack covered the launch the same morning.

Why it matters for your business

Most small businesses do not run Workday. The pattern still applies to you. Salesforce, ServiceNow, and Microsoft already let outside agents into their systems of record. Now Workday does too. Your CRM, your accounting tool, and your HR platform are turning into MCP endpoints.

The design choice to copy is this: the agent carries the user's identity, and the system of record enforces the permissions. The agent does not get a god-mode API key. If Dana in ops cannot approve a $5,000 expense, an agent acting for Dana cannot either. And the approval lands in the same audit log as a human click.

Compare that to how most small-team automations work today: one service account, full admin scope, and a prompt that says "only do X." A prompt is not a permission. When you wire an agent into QuickBooks, Shopify, or your helpdesk, scope the token to the person or the job, keep approvals in the app, and log every write.

Key takeaways

Workday's MCP tools, live SQL access, and Agent Harness runtime are generally available as of October 13, 2026
Outside agents built in Claude Code, Codex, or Cursor act under Workday's permissions, approvals, and audit trail
Policy pre-checks (Grounded Reasoning) are not due until early 2027; no pricing was announced
Systems of record are becoming MCP endpoints, so plan agent access app by app
Give agents per-user or per-job scopes, never a shared admin key with a prompt as the guardrail

Your agent should not have more access than the person it works for. We wire AI agents into the tools you already run, with scoped credentials, approvals kept in the app, and a log of every write. See how we build governed automations, or tell us which system you want an agent in first.

Sources: Workday newsroom, The New Stack.

Workday goes headless: MCP agents GA, permissions ride along

What actually happened

Why it matters for your business

Keep reading

Character.AI files Chapter 11: plan your AI vendor exit now

Blueprints AI permit-ready drawings: the seal stays human