An agent answering a workforce question needs more than a connection to current records. It needs an access boundary that matches the task. Workday’s October 13 Trusted Agent Platform announcement makes that distinction timely: the company describes headless access to HR and finance, but teams evaluating a live query still need to establish whose identity authorizes it.
The practical question is whether the connection represents the requesting employee or a dedicated system account. Those choices carry different documented scopes.
Two Access Paths Need Separate Evaluation
In its announcement, Workday said Agent-Ready Tools and Workday Data Cloud were generally available, alongside other platform components. It also said agents use Workday permissions, approvals and audit trails. These are company claims, not findings from an inspected customer deployment.
Workday’s platform explanation distinguishes MCP Agent-Ready Tools, covering data and actions, from Live Data Query, which provides direct SQL access to live business objects. That distinction matters when interpreting what a proposed integration actually connects to.
A User Identity and a System Identity Are Different Boundaries
The Live Data Query setup guide documents two authentication modes. Integration System User, or ISU, is a dedicated non-person account whose domain permissions limit authorized tables and columns. User As Self, or UAS, acts for a Workday user and applies row-level and contextual security.
The guide suggests UAS for analytics tools and AI, LLMs and agents, and ISU for data platforms. Consequently, “the agent can query Workday” is an incomplete description. A useful evaluation records the identity mode and checks whether its documented scope matches the intended question.
Live Access Is a Vendor Rationale, Not a Tested Outcome
Workday argues that an over-permissioned custom MCP service account or an external data copy can separate agents from its rules or context. Its case for direct access is therefore about retaining context as well as querying current information.
The Agent-Ready Tools for Data page says calls pass through the Workday Agent Gateway for policy checks, with agents registered in the Agent System of Record. It describes query permissions following the person represented. The reviewed material establishes those product descriptions, not their effectiveness in a particular deployment.
Workday’s product page also describes combining live Workday records with historical Agent Lake data in one query, with table, column and row-level controls. That makes the chosen connection relevant to both the data being queried and the security context Workday says accompanies it.
Can the Query Preserve the Employee-Level Boundary?
Availability needs the same precision as identity. The Live Data Query product page specifically labels native MCP access Early Access. The supplied sources do not fully reconcile that wording with the broader platform announcement. Teams should confirm the exact route instead of extending platform-level availability to every connection.
The setup guide also says enablement may depend on the subscription agreement and limits currently available objects to Workforce and Talent. The HR-and-finance announcement therefore does not establish coverage for every proposed query.
Confirm the identity mode and MCP route before calling the access path ready
A bounded evaluation should identify UAS or ISU, confirm the required objects and entitlement, and establish the selected route’s availability. It should separately assess read-query authority and actions: Workday describes human approval guardrails for actions beyond agent guardrails. This is an evaluation sequence, not a completed tenant test. No customer performance, reliability or security outcome was established.