Workday to buy C1.ai to govern AI agents' access; Sana becomes Workday Home

Workday, the US maker of human resources and finance software used by large companies, has agreed to buy ConductorOne, an identity security company that operates as C1.ai, to control what AI agents can access inside businesses. Workday signed the definitive agreement on 12 October 2026, according to its filing with the US Securities and Exchange Commission, and announced the deal at its Workday Rising conference in Las Vegas on 13 October. The price was not disclosed. At the same event, Workday said its Sana AI assistant will become the new Workday Home, the main screen employees see when they log in.

Large companies are starting to deploy AI agents that can act on their own: approving expenses, updating records, answering employee questions or drafting reports. Each agent needs access to data and systems to do its job, and that creates a new security problem. Giving an agent too much access can expose payroll, customer or financial data; giving it too little makes it useless. Identity governance, the discipline of deciding who can access what, now has to cover software agents as well as people.

By buying C1.ai, Workday is betting that the companies which already manage employee records will also want to manage their digital workers. Workday holds information about who works where, in which role and with what authority. Combining that with tools that automatically grant and remove access gives it a way to apply the same rules to AI agents that it applies to staff.

Making Sana the default home screen is the other half of the strategy. Instead of navigating menus, employees would ask the assistant to do things, and agents would carry out much of the work in the background. For enterprises, the announcements point to how business software is being rebuilt around AI agents, with security and access control built in from the start.

Short-term: Workday customers will see Sana become the main entry point to the software, and the company will begin integrating C1.ai's access controls once the deal closes.

Long-term: If enterprises adopt AI agents at scale, controlling their access through HR and identity systems could become standard practice, and other software vendors may follow with similar acquisitions.

Who is affected: Workday's enterprise customers and their IT and security teams, employees who use Workday daily, identity security vendors, and IT services firms that implement enterprise software.

Questions and Answers