The News
Workday has agreed to acquire C1 (formerly ConductorOne), an identity governance platform that has spent 2025 shipping at an unusually aggressive pace across the agentic AI security space. Over the past year, C1 introduced capabilities spanning LLM Gateway for policy-controlled AI routing, Agent Runtime Governance with intent-based access controls, enterprise-managed authorization for MCP-connected AI agents, Credential Vending, and the C1 Autonomous Worker, an AI agent purpose-built to handle identity and access management tasks. The acquisition, announced October 13, positions Workday to extend its identity governance reach from human employees to non-human identities and AI agents across the full enterprise application lifecycle.
Analyst Take
The acquisition Workday needed to make
Workday has long owned the system of record for human identity in the enterprise: who you are, what role you hold, what you’re authorized to do. That model worked well when “workforce” meant people. It breaks down when your workforce includes AI agents provisioning resources, querying databases, and calling APIs under their own identities. C1 has spent the better part of 2025 building exactly the infrastructure layer that sits between AI agents and enterprise systems, and Workday buying them is an acknowledgment that identity governance without non-human identity management is increasingly incomplete.
The strategic logic here is straightforward, but the timing is sharp. Agentic AI adoption is accelerating faster than governance frameworks can keep pace. According to ECI Research’s Google GovTech Survey, 45.6% of respondents say AI agent use is “permitted only for approved use cases under defined policies,” which sounds measured until you consider that only 4.2% say a policy is “currently under development.” Most organizations have drawn a line around agent use without building the underlying controls to enforce it. C1’s Agent Runtime Governance, intent-based access controls, and short-lived scoped tokens for MCP authorization are precisely the technical primitives those organizations need to make their policies real rather than aspirational.
Why the machine-to-machine credential problem is the real prize
For developers building agentic systems, the hardest unsolved problem isn’t model selection or prompt engineering. It’s secrets management at scale. When an AI agent needs to call an internal API, query a database, or invoke a tool via MCP, it needs credentials. Broadly shared credentials are a known liability. ECI Research’s Google GovTech Survey found that 26.0% of respondents cite “Securing machine-to-machine secrets management and API tokens” as their biggest hurdle when implementing a Zero Trust architecture at the application layer. That’s the single largest response to that question, ahead of micro-segmentation and continuous authentication challenges.
C1’s Credential Vending and C1 Egress capabilities, along with C1 Bridge for reaching MCP servers inside private networks without opening inbound firewall rules, are direct answers to this problem. These aren’t incremental features layered on a traditional IGA product. They reflect an architectural bet that agentic systems require a fundamentally different credential lifecycle, one built around short-lived, scoped, auditable tokens rather than static secrets. Workday absorbing this capability means its HCM and finance customers get a credible path to deploying AI agents in regulated environments without creating the kind of credential sprawl that security teams spend quarters trying to clean up.
What this means for the competitive landscape
This acquisition reshapes the identity governance market in a way that will put pressure on incumbents like SailPoint, Saviynt, and Okta’s IGA layer. Those vendors have been extending their platforms toward non-human identity, but C1’s 2025 product velocity, culminating in the LLM Gateway and the Autonomous Worker agent, suggests they were building for the agentic era more deliberately than the legacy players. The ECI Research finding that only 2.7% of respondents in the GovTech space are still relying on Cost-Plus contracts while 56.2% use Time and Materials arrangements also signals a procurement environment that rewards iteration speed, which is exactly what C1 demonstrated before the deal closed.
For Workday’s competitors in the HCM space, the message is that platform breadth now includes agent governance. Organizations evaluating enterprise platforms in 2026 will increasingly ask whether identity controls extend to AI agents, not just employees. Workday has bought a credible answer to that question.
Looking Ahead
The integration timeline will determine whether this acquisition delivers on its promise or becomes a cautionary tale about IGA bolt-ons. Workday’s platform is deep, and C1’s architecture is relatively new, which means the technical integration should be more tractable than a legacy merger. The more important question is whether Workday moves C1’s capabilities into the core product quickly enough to matter in competitive deals, or whether they sit as an adjacent module that customers have to discover on their own. The former requires product discipline; the latter is what typically happens.
Longer term, this deal sets a template for how enterprise software vendors will think about AI agent governance. Every platform that touches workflow automation, ERP, or finance will eventually need to answer the same questions C1 was built to address: How do you provision an agent? What can it access? How do you revoke that access when a task is complete? Workday now has an early answer. Vendors that don’t will find themselves at a disadvantage as agentic workloads move from pilot to production across the enterprise, a transition that is already well underway.
Stay Ahead of Application Development Trends
Get weekly analyst insights, research notes, event coverage, and AppDevANGLE updates delivered directly to your inbox.
Subscribe for Weekly Insights
Join technology leaders, practitioners, and GTM teams following the trends shaping modern software delivery.
Looking for deeper research access?
Explore ECI Research reports, survey insights, and market analysis through the ECI Research Portal.
