Workday's plan to acquire C1 puts a fair question in front of every security and IAM leader: what does this change for my identity program, and what doesn't it? Security and IAM leaders have been asking us, and the honest answer has two sides. For some teams an HR-led model will be enough, and for many others the hardest identity problems stay exactly where they were.
What this move gets right
Credit where it's due. Workday is right about two things.
First, AI agents need lifecycle governance. They get created, they get access, and someone has to take that access away when the work is done. Treating agents as identities with an owner and an end date is the right instinct.
Second, ticket-based provisioning is too slow. A new hire waiting days for access to Slack or a finance dashboard is a real cost. Tying access to hire, move, and leave events is a sensible fix.
We agree with both. The question is who it's enough for.
When HR-led governance is enough
For some organizations, the combined platform will cover most of what they need. Picture a mid-market company running a single Workday HRIS, a mostly SaaS estate, and a small footprint of service accounts and agents. For that team, native HR events, one data model, and one vendor accountable end to end are real advantages.
That isn't most of the enterprises we talk to. Once you have several HR systems, a large cloud or on-prem infrastructure estate, thousands of service accounts, or agents built outside HR, the picture changes. The rest of this post is about that case.
HR is the source of truth for who, not for what
At Opti, the HRIS is our anchor. It tells us who joined, who changed roles, who left, and who they report to. That context makes every access decision better, and we rely on it.
But knowing who someone is and knowing whether their access is right are different questions. The first is an HR question. The second is a security question.
An HR record says Dana moved from finance to sales in March. It doesn't say that Dana still has write access to the general ledger, that nobody else in sales has it, or that she used it twice last week. Answering that takes a view of entitlements across every application, peer group comparisons, usage data, and an understanding of what each permission can actually do.
You don't inherit that from a worker record. You build it by looking at access itself.
Risk shows up after provisioning
Lifecycle automation makes the first day and the last day faster. Most access risk builds up in between, and the data on this is hard to ignore. Microsoft's 2023 State of Cloud Permissions Risks report found that cloud identities use about 1% of the permissions they're granted, and more than half are super admins. Gartner now tracks a dedicated category, Identity Visibility and Intelligence Platforms, built around making that real-world access visible and analyzable.
In practice, it tends to look like one of three patterns:
The quiet accumulator. An engineer changes teams three times in four years. Each move adds access. Little is removed, because no HR event says "this is no longer needed."
The orphaned service account. A migration project ends. The service account it used keeps admin rights to production. It has no manager, no HR record, and no end date.
The overprivileged agent. A team deploys an agent to summarize support tickets. To get it working fast, it gets broad read access to the CRM and the data warehouse. It needs a tenth of that.
In each case, provisioning worked exactly as designed. The risk came later.
This is also where access reviews break down. Reviewers get thousands of line items with no context, so they approve them. The rubber stamp isn't a people problem. It's what happens when a review has no risk signal behind it, and faster joiner-mover-leaver (JML) automation doesn't change that.
Real environments don't fit one system
The HR-centric model also assumes every identity starts in one HR system. Few enterprises look like that.
Contractors, vendors, and partners often live outside the HRIS, or in a separate vendor management tool.
Acquisitions bring a second HR system, a second directory, and years of overlapping access.
Global companies often run different HR platforms by region.
Service accounts, API keys, and agents are created by engineering and business teams, usually with no HR event at all.
Identity security has to cover all of it, in one place, regardless of where an identity started. Your HR system should inform that picture. It shouldn't define its edges.
The questions worth asking now
What role should our HR system play in identity governance?
A central one. It's the best source for who someone is and how they relate to the organization, so feed it into every access decision. Just don't confuse it with the system that decides whether access is still appropriate.
If JML is fully automated, are we covered?
You're covered at the moments of change. You're not covered between them, which is where privileges drift and reviews turn into rubber stamps. You still need continuous risk visibility, reviews that put high-risk access first, and a way to remove access that shouldn't be there.
How do we govern AI agents that never pass through HR?
Treat them like any other identity. Discover them, assign an owner, compare what they can do with what their task requires, and close the gap. A registry tells you an agent exists. Governance tells you whether its access is right, and fixes it when it isn't.
Questions to weigh, whichever way you go
There's no universal answer, so here's how I'd frame the decision. The first two questions favor a platform built into your HR system. The rest favor an independent layer.
How much do native HR events matter to you? A platform inside your HRIS sees every hire, move, and leave first and with full fidelity. An independent layer has to integrate to get the same signal.
Do you want one vendor accountable end to end? Fewer contracts and one support line are worth a lot to a lean team.
Does it cover human, non-human, and agentic identities in one model, including those that never appear in HR?
Does it work across all of your HR systems, identity providers, and applications, in the cloud and on-prem?
Are access reviews driven by risk, so reviewers focus on what matters instead of approving everything?
Does it fix problems, or only report them?
If the first two carry the most weight for you, a suite may be the right call. If the last four do, you need something that governs access on its own terms.
Where we stand
At Opti, we anchor on the HRIS, Workday included, and govern what happens after provisioning: the access that drifts, the accounts nobody owns, and the agents nobody reviewed. HR will keep getting better at knowing who works here, and our job is making sure what they can touch stays right.
Barak Perelman is CEO and co-founder of Opti, an AI-native identity security platform. See how Opti works.
