Concept: Agent Security

Agent Security ensures that AI agents operate securely within your enterprise by assigning them unique identities, robust authentication, and granular authorization controls. Agent security governs how agents interact with data and perform tasks, abiding by the principle of least privilege.

Workday secures AI agents using the same robust framework used for workers. To ensure a trusted environment, the system applies the principle of least privilege through two distinct layers of protection:

Governance: By treating agents as non-human identities, Workday prevents agent sprawl and ensures every machine action is tied to a specific, manageable account.

Transparency: Every action performed by an agent is fully auditable, providing the same level of visibility into agent actions as you have for employees.

While you manage the lifecycle and definition of your agents in the Agent System of Record (ASOR), Agent Security dictates their runtime behavior.

The Agent Security framework supports 2 distinct agent execution modes:

Delegate Mode: Acting on behalf of a user. Example: A user delegates to the agent the task of requesting a day off for a specific date.

Ambient Mode: Acting autonomously based on an event trigger or schedule. Though an agent isn’t fully autonomous, the agent operates independently to perform background tasks, such as aggregating data pools or responding to event triggers.

Agent Identity: Agent System User (ASU)

Similar to an Integration System User (ISU), Agents use Agent System User accounts (ASUs). To guarantee that there is unambiguous control over what the agent can access and to provide transparency for auditing, each agent has a unique identity, or user account.

Unique Identity: Each agent has a unique ASU account.

Mode-Specific: An agent can have up to 2 ASUs; 1 each for delegate execution and ambient execution. Each ASU will have a specific OAuth 2.0 client.

Management: The system automatically generates and manages ASUs when you configure skills in the Agent System of Record. Example: Activating an ambient skill triggers the creation of the necessary ambient ASU.

ASU Creation and Registration

The ASU creation process occurs in tandem with the agent's configuration and skill enablement in ASOR.

ASU Generation: When an administrator enables skills for an agent, ASOR automatically creates a dedicated Delegated ASU or Ambient ASU for that agent in a disabled state. When the agent is activated, the associated ASUs are automatically enabled.

OAuth Client and Key Pair: An OAuth client is generated and attached to an ASU. A private key pair is created, and the public key is registered with the Workday authorization server. The ASU is then granted the ability to authenticate and perform tasks defined in its skills.

Credential Storage: ASOR securely stores the client credentials, including the private key, in the Credential Store. A unique reference ID is then stored in ASOR as a pointer to these key-pair credentials, which are used to generate ASU tokens that are exchanged along with the user token for a delegated ASU, rather than for OAuth 2.0 client credentials.

Comparison of Security Modes

Feature	Delegate Mode	Ambient Mode
Primary Use Case	Interactive tasks. Example: Request time off for yourself.	Background tasks. Example: Data aggregation.
Identity Used	Combination of user and agent ASU.	Agent ASU only.
Authentication	The agent uses the OAuth 2.0 in the On-Behalf-Of flow. First-party (1P) agents: The access token is valid for up to 60 minutes when you use the Authorization Code grant. Third-party (3P) agents: The access token is valid for 4 hours. You can’t customize access token expiry for third-party agents currently.	The agent authenticates as an ambient ASU, with no user involvement.
Authorization Logic	The system evaluates security based on the intersection of the user's permissions and the agent's allowed skills.	The system evaluates security solely against the agent's permissions.
Configuration	Agent Interaction Policy: Defines who can interact with the specific agent skills.	Domain Security Policy: Defines what the agent can access.
Security Groups	The user must be in the allowed security groups for the skill to invoke it.	When an ambient skill is activated, a unique Ambient Agent Security Group is generated and must be assigned to the relevant domain or business process security policies.
Audit Log	Records the transaction as performed by the agent as By User and the user as On Behalf Of User .	The audit log shows the agent ASU as the By User .

Implementation Considerations

Workday provides a Security Analysis
report for the domain and business process security policy configurations for agent skills. This report helps you identify what security configurations are necessary for your agents.