Workday Signs Deal to Acquire Agentic Identity Platform C1.ai

Workday announced on October 13, 2026, at Workday Rising 2026 in Las Vegas that it has signed a definitive agreement to acquire C1.ai, which the company described as an agentic identity platform for people and AI agents.

According to the announcement, C1.ai connects to the systems a business runs on, from email and CRM to code repositories, finance systems, and cloud infrastructure, giving each person and agent the right access at the right time and removing that access when it is no longer needed.

The transaction is expected to close in the fourth quarter of Workday’s fiscal year 2027, which ends January 31, 2027, subject to the satisfaction of customary closing conditions. BofA Securities is serving as financial advisor to Workday, with Orrick as its legal advisor, while Qatalyst is serving as financial advisor to C1.ai, with Ashurst Perkins Coie as its legal advisor.

Gerrit Kazmaier, Workday’s president of product and technology, said companies now run on a combined workforce of people and AI agents. “With C1.ai, we’ll help secure that workforce by managing and enforcing exactly who – and what – has access to connected apps and systems, giving each person and agent the right access at the right moment to make work easier, safer, and more compliant,” he said.

Access Governance Across the Employee Lifecycle

Workday said most organizations manage employee access across hundreds of applications through manual service tickets, spreadsheets, and periodic reviews as workers join, change roles, and leave. The announcement describes a new hire spending their first days filing tickets to get access to tools such as Slack, Jira, and a finance dashboard, then keeping that access long after changing roles.

Workday said it and C1.ai will bring those processes together so that new hires receive the right access when they start, employees gain and lose access as their roles change, and departing workers are removed promptly. The company said this approach means less time waiting on system permissions for employees, fewer manual approvals for managers, and fewer open doors for attackers.

Workday said every new hire, job change, and exit is already a Workday event, and that it already governs the people, money, and agents at the heart of the enterprise. With C1.ai, the company said, it will become the identity governance layer for people, money, and agents.

Visibility and Control for AI Agents

The announcement draws a line between agents that act on behalf of an employee, which should reach only part of what that person can access, and agents that work on their own with broader access that needs close oversight. The release states that a retired agent should not still be able to get in, and that most companies do not yet have a way to manage access at that level of detail.

Workday’s Agent System of Record already gives companies one place to see and manage their agents. The company said C1.ai will build on that registry, moving beyond registering agents to also governing what they can access across Workday and other enterprise systems. Once an agent is registered, it can receive the access it needs when it needs it and lose that access immediately when its work or role ends, according to Workday.

Alex Bovee, C1.ai’s CEO and co-founder, said enterprises cannot secure the AI era using yesterday’s IT tickets. “Workday is the operational heart of the enterprise, and by bringing C1.ai’s identity governance directly into that core, we’ll be able to manage access for every human and agent in real time – making work faster without making it less secure,” he said.

Survey Data Cited in the Announcement

The acquisition release points to C1.ai research showing that 95% of large U.S. companies already run autonomous agents, and to Deloitte’s State of AI research finding that only 21% of companies report having a mature way to govern them.

C1.ai’s third annual Future of Identity Report, released March 10, 2026, surveyed 508 IT and security leaders at U.S. organizations with more than 1,000 employees. It found that 95% of organizations now run AI agents that autonomously perform IT or security tasks, compared with 96% that said a year earlier they planned to operationalize agents.

The report found that 80% of organizations experienced at least one identity-related breach in the past year, with phishing and social engineering cited by 52% and malware or ransomware by 46%. It found that 47% of organizations have more non-human identities than human users while only 22% report full visibility into those identities, and that 91% increased spending on identity and access management.

The survey also found that 31% of respondents say their organizations already operate in what the report calls an agentic-enterprise model, with another 32% running early agentic workflows in production and 25% piloting AI agents for operational tasks.