If you run C1.ai (formerly ConductorOne) for access reviews or just-in-time access, your identity governance vendor will soon belong to your HR vendor, and nobody has told you what that means for your contract. Workday signed a definitive agreement to acquire C1.ai on October 13, 2026, at Workday Rising in Las Vegas. The plan is to let hires, role changes and departures recorded in Workday grant and remove access automatically, for employees and for AI agents. Closing is expected in Workday's fiscal fourth quarter, which ends January 31, 2027. That gives you roughly three months to get continuity terms on paper while C1 is still an independent seller.
The price was not disclosed. Neither Workday's release, filed with the SEC as an exhibit to its 8-K, nor C1's own copy of it says anything about existing C1 customers, whether C1 stays available as a standalone product, or what happens to companies whose HR system of record is something other than Workday.
What Workday Is Actually Buying
Workday is buying an access-control engine to bolt onto the agent registry it already sells. C1.ai is an identity governance and administration (IGA) platform: software that decides who gets access to which application, records who approved it, and takes the access back. The release says C1 connects to email, CRM, code repositories, finance systems and cloud infrastructure to grant and remove that access.
C1's integrations page lists 400+ prebuilt connectors, including Okta, Microsoft Entra ID and Active Directory on the identity side, and Workday, Oracle Fusion Cloud HCM and SAP SuccessFactors on the HR side. The same page lists a C1 MCP Gateway product, which the pricing page describes as "identity-aware policy for MCP with enforced guardrails." In June the company shipped C1 Autonomous Worker, an agent that runs access reviews and revokes stale grants inside the same policy engine as human admins.
The company is small and young. Based in Portland, it renamed itself from ConductorOne to C1 on April 7, 2026, and raised $79 million in fall 2025 in a round led by Greycroft with Accel and Felicis. Its customer page names Qualtrics, Instacart, Brex, DailyPay, DigitalOcean and PriceSmart.
The thing it plugs into is Workday's Agent System of Record, announced in February 2025 as one place to onboard, track, budget for and manage AI agents built by Workday and by third parties. An Agent System of Record is a registry that treats each AI agent like a worker record: it has an owner, a role and a lifecycle. What it lacked was enforcement in the systems where agents act. C1 supplies that.
Why HR Wants to Own the Off Switch
Workday's argument is that the HR record already knows when someone joins, moves or leaves, so it should drive access directly. Per the release, agents would be registered in the Agent System of Record and then lose access when their work or role ends, replacing tickets, spreadsheets and periodic reviews.
Workday's Aneel Bhusri told diginomica at Rising that "there'll only be one source of truth, and that will always be the HR system for employees," and placed agents in the Agent System of Record. Gerrit Kazmaier, Workday's president of product and technology, estimated in the same diginomica report that agents could outnumber humans 50 to 100 to one within two or three years. That is a forecast from the buyer, and you should treat it as one.
The steel-man for the deal is strong. Access nobody removed is the classic identity failure: the contractor who left, the service account from a dead project. Driving provisioning from the HR record is long-standing IGA practice, and C1 already reads HR data to do it. Its Workday connector pulls from All Active and Terminated Workers. Putting the same discipline on agents, which have no manager to notice they are still running, is a reasonable design.
The release backs its urgency with two numbers worth reading carefully: 95% of large US companies already run autonomous agents, per C1's own research, and 21% report a mature way to govern them, per Deloitte. The first is a vendor survey from the seller.
What the Announcement Leaves Out
The gap is anyone whose HR system isn't Workday. C1 today lists connectors for Oracle and SAP HR systems, and for identity layers such as Okta and Entra. The release names no other HR system at all, and the trade coverage at ID Tech and diginomica adds nothing on customers, pricing or standalone availability.
The only reassurance is about identity providers, not HR systems. Bhusri told diginomica: "We can work with other IDPs, whether it's Microsoft or Okta." He also noted he was a founding investor in Okta. That covers where users authenticate. It says nothing about whether a C1 customer on Oracle Fusion HCM keeps a first-class product once Workday sets C1's roadmap.
Pricing is the second open question. C1's pricing page sells platform plans by managed identities, in tiers from 100 to 20,000, plus a "Flex" option that bills usage in C1 Tokens monthly. No dollar figures are published, and the page now carries a banner saying C1 is joining Workday. If C1 becomes a Workday module, nobody has said whether the managed-identity meter survives, and agents are the identities most likely to multiply under it.
Look closely at the connector, too. C1's own docs for the Workday integration do not list provisioning as a capability; today C1 reads Workday workers, roles and security groups and governs access elsewhere. The "HR event triggers access change" flow in the release is a plan, and it depends on integration work that has not shipped.
The Last Identity Deal Looked the Same
ServiceNow's purchase of Veza is the closest precedent, and it went the way you would expect. ServiceNow announced the deal on December 2, 2025 and said Veza's capabilities would be incorporated into its security portfolio and its AI Control Tower. The release noted Veza's nearly 150 enterprise customers and said nothing about their contracts. The deal closed on March 2, 2026.
The identity community blog Start with Identity reported the price at about $1.2 billion and called the deal "commercially awkward." Veza had sold well to companies running SailPoint or Saviynt, and that neutrality is harder to keep inside a platform with its own governance ambitions. Its advice to Veza overlay customers was to check licensing at renewal. We covered how ServiceNow folded Veza into its agent governance pitch in May.
Okta's Permiso purchase raised the same question, and we argued then that buyer leverage runs out around the close date. In both deals the press release described the acquirer's platform and left existing customers to learn their terms at renewal.
C1 is now in that position. Part of its appeal was that it sat between your HR system, your IdP and your apps without belonging to any of them. After close, Workday owns it.
What To Do Before Workday's Q4 Close
This Week:
- Pull your C1 order form and find the renewal date, the price-increase cap, the termination-for-convenience language and any change-of-control clause. If your renewal falls after January 31, 2027, the contract you renew will be negotiated with Workday.
- Write down which HR source your C1 tenant uses today. If it is Oracle Fusion HCM, SAP SuccessFactors or a CSV export, you are the customer the announcement did not address. Ask your C1 account team in writing whether that source stays supported after close, and for how long.
- List every agent and MCP server currently routed through C1's MCP Gateway or approved by C1 Autonomous Worker. That inventory is what you would need to rebuild elsewhere.
This Month:
- Ask for a signed letter, before close, committing to standalone availability, current connector support and the managed-identity pricing model for at least one renewal term. Sellers give these more easily before the acquirer's legal team takes over.
- Get an export of your access-review history and approval logs in a format you control. Auditors will ask for the last cycle's evidence whatever happens to the vendor.
- If you run Workday HCM, ask Workday for a dated roadmap for HR-triggered provisioning, since the current connector does not provision. Do not retire an existing joiner-mover-leaver flow on a slide.
Before Your Next IGA Renewal:
- Price one alternative so the negotiation has a floor. Our Okta vs Entra Agent ID vs SailPoint comparison covers who issues agent identities and who governs them; Okta for AI Agents, Saviynt Zuma and ServiceNow AI Control Tower are the obvious comparisons.
- Decide as a policy question, with the CHRO and CISO in the same room, whether HR should become the system of record for agent identity. Workday's earlier Agent Passport and its $3B agent platform plan show where it wants that answer to land.
The Bottom Line
This deal moves identity governance one layer upstream, from the security stack into the HR system. Identity and HR have met before: IGA tools have long provisioned from the HR feed, and they stayed neutral about which HR system sent it. Workday is betting that agents need a different arrangement, with the HR vendor owning the registry and the enforcement both. That may be right for a company that runs Workday for everything. For the C1 customers who don't, the open question is whether a neutral tool stays neutral, and the same thing happened to Workday Skills Cloud customers after SAP bought TechWolf last week, from the other direction.
Get the standalone and connector commitments in writing before January 31, 2027.
Continue Reading
- Okta vs Entra Agent ID vs SailPoint: Two Issue, One Governs
- Okta Bought Permiso. Your Leverage Expires Oct 31.
- ServiceNow's CISO Play: Armis + Veza Govern AI Agents
- Workday's $3B Bet: A New Operating System for AI Agents
- SAP Buys TechWolf, the Skills Engine Feeding Workday's Skills Cloud
- Adobe Took Rilo's Team. Its Slack Token Never Expires.