Concept: Agent Interaction Policy

The Agent Interaction Policy is a security configuration within the Agent System of Record (ASOR) that explicitly defines which users are authorized to converse with or invoke specific agent skills.

How It Works

The policy functions as an opt-in mechanism for an agent’s delegate mode skills. If a user isn't in the security group for an agent skill, the user can't use that skill even if the user has access to the domain or business process security policies for the tools in that skill. When a user attempts to interact with an agent, the Workday Agent Security framework performs a two-step security evaluation:

Agent Interaction Check: The system checks whether the user belongs to a security Group included in the agent’s Agent Interaction Policy, which is configured in the

Available To

list. If the user isn’t a member of any of these groups, the agent interaction is denied, even if the user has the necessary security permissions to perform the tasks defined in the skill’s

Tools

section.

Domain & Business Process Check: If the user passes the interaction check, the system then verifies their standard permissions including domain and business process security policies, to ensure they are authorized to see the data or perform the action requested. Domains are checked not only for the tools, but also at the field level when the agent’s skill is executed, which is consistent with how domain security works without agents..

Applicability

Workday allows you to configure the Agent Interaction Policy only for agents and skills that operate in the delegate mode.

Delegate Mode: Requires an Agent Interaction Policy. You must explicitly opt-in security groups to allow them to use these skills.

Ambient Mode: Doesn't use Agent Interaction Policy. As ambient agents act as themselves in the background based on triggers or schedules, they don’t interact directly with a user and therefore don’t require a policy defining which user can interact with them.

Configuration

You can define Agent Interaction Policy in the

Agent Management Hub

or during agent registration by configuring the

Available To

settings for a specific skill.

Example: For a Recruiting agent with a Job Requisition Creation skill, you can add the Recruiters security group to the

Available To

list. Only users in the Recruiters security group can request the agent to create a requisition. A user in the Employee As Self security group can’t use this skill, even if they had domain access to create requisitions.