Set Up Sana From Workday for Gemini Enterprise

In Workday:

Review setup considerations for Agent System of Record. See Setup Considerations: Agent System of Record.

Configure tenant security access for the Self-Service Agent. See Set Up Security for Workday Everywhere Using Self-Service Agent.

ASOR Admin permissions in the Security Configuration
domain in the System functional area.

In Gemini Enterprise:

Verify that you have administrative permissions for the Google Cloud Console project and an active Gemini Enterprise account with 1 of these Identity and Access Management (IAM) role combinations on the Cloud Billing account:

roles/billing.admin
. See Billing Account Administrator.

roles/billing.user
. See Billing Account User.

roles/consumerprocurement.orderAdmin
. See Consumer Procurement Order Administrator.

If you don't have the required roles, request access from a Billing Administrator or Organization Administrator. See Access control with IAM.

Verify your Google Cloud Billing account and share it with Workday to receive the private offer.

Access the private offer link sent by Workday in an email.

Accept the private offer in Google Cloud Marketplace. See Cloud Billing access control and permissions.

Sana from Workday in Gemini Enterprise enables workers to interact with Workday through conversational AI in Google Cloud. Workers can use the chat interface to find information, complete certain tasks, and get support without accessing Workday.

Examples:

Change my marital status.

How much vacation time do I have?

Help me optimize my time off for the year.

Access the

task.

Security: Security Administration
domain in the System functional area.

Enter these values:

Option	Value
Client Name	Gemini Enterprise Setup
Client Grant Type	Authorization Code Grant
Access Token Type	Bearer
Redirection URI	https://www.google.com
Refresh Token Timeout (in days)	30
Scope (Functional Areas)	Agent System of Record
Include Workday Owned Scope	Select

Click

Record the client ID and client secret generated by Workday.

Generate the Access Token and Create the 3P Agent Definition

Enter this URL in a new browser tab to request an authorization code:

https://<agent-gateway-hostname>/auth/authorize/<tenant-alias>?client_id=<client-id>&response_type=code

Placeholder	Value
<agent-gateway-hostname>	The regional endpoint for your tenant. See Regional Availability of Agent Gateway.
<tenant-alias>	Your tenant alias.
<client-id>	The Client ID you copied after registering the API client.

Sign in to Workday as a user with access to the Setup: Agent
domain and copy the authorization code from the URL response.

Call the

/token

endpoint using your terminal or API client to retrieve the access token.

You can run the Get Token request in the provided Postman/Bruno collection, or you can copy this curl and paste it into your terminal.

curl --request POST \
    --url https://<agent-gateway-hostname>/auth/oauth2/<tenant-alias>/token \
    --header 'content-type: application/x-www-form-urlencoded' \
    --data 'grant_type=authorization_code&code=<auth-code>&client_id=<client-id>&client_secret=<client-secret>'

You can also download the Gemini-3P-Agent-Setup.zip file to use the curl command and demo video.

Replace the placeholders with these values:

Placeholder	Value
<agent-gateway-hostname>	The regional endpoint for your tenant. See Regional Availability of Agent Gateway.
<tenant-alias>	Your tenant alias.
<client-id>	The client ID you copied after registering the API client.
<client-secret>	The client secret you copied after registering the API client.
<auth-code>	The value you copied after requesting the authorization code.

Record the

access_token

from the response.

Call the

/asor/v1/agentDefinition

endpoint to create the 3P Agent Definition request.

You can run the Create 3P Agent Definition request in the provided Postman/Bruno collection or copy this curl and paste it into your terminal:

curl --request POST \ 
    --url https://<agent-gateway-hostname>/asor/v1/agentDefinition \ 
    --header 'authorization: Bearer <bearer-token>' \ 
    --header 'content-type: application/json' \ 
    --header 'wd-agent-tenant-alias: <tenant-alias>' \ 
    --data '{ 
       "name": "Gemini Enterprise", 
       "description": "Gemini Enterprise 3P Agent that can invoke agents via A2A", 
       "url": "https://console.cloud.google.com/gemini-enterprise/apps", 
       "documentationUrl": "https://docs.cloud.google.com/gemini/enterprise/docs", 
          "provider": { "id": "Provider=Self-Built" }, 
          "iconUrl": "https://cdn1.iconfinder.com/data/icons/material-design-icons-light/24/link-variant-512.png", 
          "version": "1.0.1", 
          "capabilities": { "streaming": false, "pushNotifications": false, "stateTransitionHistory": false }, 
          "platform": { "id": "b49b32cfdbef10002184b61535490000" }, 
          "defaultInputModes": [{ "type": "text/plain" }], 
          "defaultOutputModes": [{ "type": "text/plain" }, { "type": "application/json" }], 
          "skills": [{ 
            "id": "ssa-agent-as-a-tool", 
            "name": "Sana Self-Service Agent", 
            "description": "Connects to Sana Self-Service Agent", 
            "tags": [{ "tag": "hr-operations" }], 
            "inputModes": [{ "type": "text/plain" }], 
            "outputModes": [{ "type": "text/plain" }, { "type": "application/json" }] 
            }], 
        "workdayConfig": [{ 
           "skillId": "ssa-agent-as-a-tool", 
           "executionMode": { "id": "Mode=Delegate" }, 
           "workdayResources": [{ 
             "tool_name": "Sana Self-Service Agent", 
             "description": "Connects to Sana Self-Service Agent", 
             "agent_resource": { "id": "6bfadd7c014610000dffae8d77c00000" } 
            }] 
       }] 
}'

You can also download the Gemini-3P-Agent-Setup.zip file to use the curl command and demo video.

Replace the placeholders with these values:

Placeholder	Value
<agent-gateway-hostname>	The regional endpoint for your tenant. See Regional Availability of Agent Gateway.
<tenant-alias>	Your tenant alias.
<bearer-token>	The access_token you just recorded.

Configure and activate the agent in Workday.

Access the

Agent Management Hub

report.

Select the

Agent Registry

tab, and click

Gemini Enterprise

Click

Configure Agent

Complete the agent configuration:

Option	Description
Status	Select to activate the agent
Available To	Select the security groups that require access to the skill.

Click

Save

Enter

Redirect URI

https://nw.myworkday.com/api/a2a_callback

and click

Record the client ID and client secret.

Click

Activate

, and then click

Activate

again on the pop-up.

Add and configure the agent in Gemini Enterprise.

Open Gemini Enterprise in your Google Cloud project.

Click

Create App

In the

Agents

section, select

Add Agent

Agents via Marketplace

Select Sana from Workday Agent
and click

In the

Agent Authorization

section, complete the configuration using the client ID and client secret from Workday.

Option	Value
Client ID	The client ID you copied after registering the API client.
Client Secret	The client secret you copied after registering the API client.
Auth URL	https://nw.myworkday.com/api/a2a_authorize
Token URL	https://nw.myworkday.com/api/a2a_token
PKCE Verification Enabled	Select

On the

Agents

tab, click

Sana from Workday

and click

User Permissions

Click

Add User

and select the applicable users or groups. Example: All users
or a pilot group.

From the

Assign Role

prompt, select Agent User and click

Save

Open the Gemini application, select Sana from Workday
on the

Agents

tab, and start a chat session.

When Workday prompts you to authorize the connection click

Authorize

Enter your Workday

Tenant Alias

and click

Continue