Setup Considerations: Agent Security
You can use this topic to help make decisions when planning your agent security configuration. It explains:
- Why to set them up.
- How they fit into the rest of Workday.
- Downstream impacts and cross-product interactions.
- Security requirements.
- Questions and limitations to consider before implementation.
What It Is
The Agent Security framework governs the identity, authentication, and authorization of AI agents within your tenant. Unlike standard chatbots, agents can execute significant tasks in enterprise systems, such as requesting time off or retrieving paycheck information. The framework ensures agents operate under the principle of least privilege, with robust controls for both autonomous and user-driven interactions.
Business Benefits
- Enhanced Governance: Ensures that agents, like workers, have unique identities and auditable activity logs.
- Granular Control: Enables you to restrict agent capabilities based on the execution mode, ensuring agents only access data they are explicitly authorized to handle.
- Transparent Auditing: Provides clear audit trails that distinguish when an agent acts autonomously versus when it acts on behalf of a user.
Use Cases
- Interactive Assistance on delegate mode: Interactive Assistance on delegate mode: A user asks an agent to request the next Monday off. The agent executes the request on behalf of the user. Security is evaluated based on the intersection of the user's permissions and the agent's allowed skills.
- Background Processing on the ambient mode: An agent automatically aggregates data pools or evaluates datasets based on a schedule. The agent acts as itself, using its own security permissions without user intervention.
Questions to Consider
Question | Consideration |
|---|---|
Which execution mode does your agent require? | There are 2 distinct agent execution modes:
|
Who is permitted to interact with and invoke a specific delegate agent skill? | You must define an Agent Interaction Policy that specifies which user security groups can interact with the agent's skills. The invoking user must be in the allowed security groups for the skill to successfully trigger it. |
How will you manage agent identities? | Agents require unique Agent System User (ASU) accounts. An agent can have up to 2 ASUs: 1 for delegate mode and one 1 ambient mode. |
What specific data domains or business process actions does an ambient agent need to access? | An ambient agent's permissions are evaluated solely against its own Agent System User (ASU) permissions. You must assign the unique Ambient Agent Security Group to the required domain or business process security policies. |
Which authentication components must the integrating application like Agent Forge support? | For delegate Mode, the system uses an OAuth 2.0 On-Behalf-Of flow that involves exchanging the User Alpaca Token for a Delegated Access Token. You must ensure the application can handle the necessary token types and header requirements. |
Can I configure ASUs to work with proxy accounts? | No, ASUs don't support proxy accounts. |
Recommendations
- Abide by the principle of least privilege. Only grant agents the minimum necessary access to domains and business processes required for their specific skills.
- Use separate ASUs for each mode. Ensure that each agent has distinct accounts for delegate and ambient execution to prevent confusion in authorization and auditing.
- Review the Security Analysis Report. Use this report to surface the domain and business process security policy configurations for your agent skills.
- Audit Trail Review: Regularly examine the audit log for agent actions. The log clearly distinguishes between an ambient agent operating alone and a delegate agent acting on behalf of a specific user.
Requirements
- Define the security policies and enable the agent's skills in the Agent System of Record (ASOR) to generate an Agent System User (ASU) and its credentials.
- The generated ASU and its associated OAuth client are disabled by default. You must activate an agent to enable the agent for use.
- For delegate agent mode, the user making the requests must have security access to the underlying agent tools and tasks.
Limitations
- Dual Identity Requirement: An agent that needs to operate in both delegate and ambient modes must have separate ASU accounts and credentials configured for each execution mode.
- Key Management: While ASOR handles the creation and secure storage of the client credentials (private key) in the Credential Store, you must ensure your security environment supports the OAuth 2.0 token-exchange process that utilizes this key pair.
Tenant Setup
NA
Security
Security groups managing agents require
View
and Modify
access to Report/Task permissions to view and execute agent tasks, and Put
access to Integration permissions to transfer agent configuration data.Domains | Considerations |
|---|---|
Manage: Agents
| Provides access to setup tasks and activities for the Agent System of Record (ASOR). |
Setup: Agents
| Provides access to tasks for configuration, activation, and deactivation of agents. |
Agent Management Hub
| Provides access to the centralized hub for viewing and managing all agents. |
Reports: AI Agent Security
| Provides access to the new View AI Agent User Audit Trail report. |
Reporting
- View Security for Agent Skill: Displays the domain and business process security policy configuration for agent skills. You can access this report from the related actions menu of an agent skill.
- View AI Agent User Audit Trail: Displays user activity, distinguishing between By User and On Behalf Of User. You can access this from the related actions of an agent and as a standalone task.
Connections and Touchpoints
The Agent Security framework touches the following key areas of Workday:
Features | Considerations |
|---|---|
Workday Configurable Security | Agent permissions rely entirely on domain and business process security policies and security groups, which control who can access secured items. |
Agent System of Record (ASOR) | ASOR manages the definition and configuration of agents and acts as the system of record for agent security policies and credential reference IDs. |
OAuth 2.0 Authentication | The agent authentication flow uses OAuth for the On-Behalf-Of token exchange in delegate Mode. First-party (1P) agents: The access token is valid for up to 60 minutes when you use the Authorization Code grant. Third-party (3P) agents: The access token is valid for 4 hours. You can’t customize access token expiry for third-party agents currently. |
Workday REST APIs | Agent access to Workday data is carried out through REST API endpoints, which are secured to specific domains or business process security policies. |
Workday offers a Touchpoints Kit with resources to help you understand configuration relationships in your tenant. Learn more about the Workday Touchpoints Kit on Workday Community.