The moment worth replaying from Workday's earnings call last Wednesday is a single word. CEO Aneel Bhusri, describing third-party vendors that build on Workday's data, called them "parasites" and said the company would "put an end to that." The product launches that accompanied the call, two new AI agents and a consumption-based pricing model called Flex Credits, got the coverage. The word got less attention. It should have gotten more, because it tells you what Workday's Agent System of Record is underneath the governance language: an economic interface built on HR workflow.
Bhusri's full framing, from the Q4 FY2026 earnings call on May 21:
"There are some vendors out there, including some of our peers that would consider them, at some level, parasites on Workday. They get a free ride on our underlying system of record, and we're going to put an end to that. If you run stuff off of Workday, whether it's from our agents or third-party agents, there will be — there's a consumption model tied to it."
A CEO telling investors he's going to meter every API call against his platform is describing a toll booth, whatever governance language surrounds it. The governance product is the on-ramp.
That framing matters because Workday is making one of the more interesting structural bets in enterprise software right now, and the bet has a flaw that Workday's own people are already describing on the record. The bet: that the frameworks enterprises use to hire, onboard, scope, and terminate human employees are the right governance model for AI agents. The flaw: those frameworks carry an implicit clock speed, and nobody has explained how that clock speed survives contact with a population that grows at machine pace and doesn't quit.
Four stages, one assumption
Workday's Agent System of Record went generally available in February 2026. ASOR is a centralized registry and management plane for AI agents, organized around four lifecycle stages, register, configure, activate, deactivate, that deliberately mirror how an HR system handles a human employee. Agents are modeled as role-based entities mapped against existing org structures and approval authorities. The official datasheet describes agents that "become part of an organization's workforce strategy — measured like investments, governed like employees, and improved by training and learning."
The adoption numbers tell a layered story. Workday reported 1.7 billion AI actions across fiscal year 2026 and over 400 customers actively using its 12 role-based agents. A broader population has registered agents in ASOR; Workday hasn't broken out the exact figure publicly, but the company's March 2026 "Next Wave" announcement and surrounding materials reference a significantly larger cohort. Registering an agent in the system of record and actively governing an agent population at scale are different activities, and the gap between them is worth examining closely. Dean Arnold, Workday's VP of AI Platform, described adoption in an April 2026 Diginomica interview as "still quite early," with external agent connections via MCP and A2A protocols "largely at a testing phase rather than in full production mode."
Most of the installed base, in other words, is in observation mode. Registration is the first lifecycle stage. Active governance at scale is the destination. The distance between those two points is where the governance clock problem lives.
The clock speed underneath
The HR governance model carries an implicit clock speed, and that clock speed is the thing worth examining.
Human workforces operate on human organizational rhythms. Hiring takes weeks. Onboarding takes days. Role changes flow through approval chains that assume the approver is a person checking email between meetings. Performance reviews happen quarterly. Termination involves paperwork and access revocation sequences designed around the assumption that the departing entity will eventually walk out a door. The entire apparatus assumes a population that grows incrementally, changes roles infrequently, and persists for months or years.
AI agents don't work like that. An agent can be instantiated in seconds, replicated across hundreds of instances, scoped to a task that completes in minutes, and dissolved. An enterprise deploying agents at real scale will have a population that grows, mutates, and shrinks at a pace that makes quarterly reviews absurd and individual lifecycle tracking a bottleneck.
My read is that this clock-speed mismatch is the structural tension underneath Workday's entire ASOR strategy. The product appears to work at current scale. The "agent as employee" metaphor is genuinely intuitive. But a governance grammar designed for human organizational time faces a specific test as agent populations grow: does it scale to machine organizational time without becoming either a bottleneck or a ceremony?
The toll booth underneath the governance layer
To understand why Workday built ASOR the way it did, start with the economics underneath the product design.
ASOR itself is free. Workday customers get the agent registry, lifecycle management, and observability at no incremental cost. Arnold confirmed this in the Diginomica interview: the enterprises using ASOR are Workday customers "for whom it comes free of charge."
What isn't free is what agents do. Workday introduced Flex Credits, a consumption-based pricing model that meters API calls and agent actions. Gerrit Kazmaier, President of Products and Technology, described the mechanism on the earnings call: consumption is captured in the form of API calls, monetized on Flex Credits. But management repeatedly characterized Flex Credits revenue as a second-half fiscal 2027 motion, with revenue recognized ratably. The economic model is still being built while the governance model is already shipping.
A company telling investors its monetization model is a future event while shipping the governance layer now. The sequencing is deliberate. The registry is free because the registry is the toll booth's on-ramp. Every agent that registers in ASOR and takes actions against Workday data generates metered revenue. More agents, more actions, more Flex Credits consumed.
This creates a tension that matters for the governance clock problem. The governance layer is designed to control agent populations: register them, scope their permissions, decommission them when they underperform. The revenue layer benefits from agent populations growing and doing more work. At the margin, governance and revenue pull in opposite directions. A governance framework that aggressively decommissions low-ROI agents reduces Flex Credits consumption. A revenue model that rewards proliferation makes governance ceremonial.
The two dimensions of the clock-speed problem converge at exactly this point: the faster agents proliferate, the harder they are to govern at human pace, and the economic incentive is for them to proliferate. The governance clock is too slow, and the economics actively resist speeding it up. Workday's 10-Q for the quarter ended April 30, 2026 acknowledges this uncertainty directly, noting that "the markets and monetization strategies for certain of our offerings, including our agentic AI solutions" remain early. The legal team doesn't yet treat agent revenue as a reliably modeled stream.
Where the metaphor cracks
Workday's own people are seeing the limits of the HR metaphor, and they're saying so on the record. Arnold, in the Diginomica interview, made a striking concession:
"An agent has the opportunity to be able to span different processes out of organizational trees and charts and actually work across different areas. There are limitations, therefore, in mapping agents to a traditional org chart."
That's Workday's VP of AI Platform saying the core abstraction ASOR is built on, agents as employees governed by org-chart logic, has structural limits Workday already recognizes. Agents cross organizational boundaries, operate across process trees, and resist the hierarchical reporting structures that HR systems use to scope permissions and accountability.
Arnold went further, describing an exploratory concept called the "work chart," which maps tasks and skills used to complete work rather than the roles people fulfill, and uses those mappings to inform agent permissions. The work chart is not a product. It's an R&D direction. But its existence is a tell: the people closest to the product can see the clock-speed mismatch coming and are building a hedge against it inside Workday's own organization.
The gap between the shipped product (agents governed like employees, mapped to org charts) and the R&D direction (agents governed by task graphs, mapped to workflows) is the gap this piece is about.
The pattern from infrastructure
The governance clock problem isn't new. It shows up every time a governance framework designed for one population gets extended to a fundamentally different one.
The progression from virtual machines to containers to serverless functions is instructive.
VMware built a governance model for virtual machines: long-lived, individually named, managed imperatively. You knew the name and address of every running thing. You configured each one. You tracked its lifecycle over months or years. When containers arrived, the unit of compute changed. Containers are ephemeral, scaled via replica sets, managed declaratively: you describe the desired state, and the system continuously checks whether reality matches that description and corrects the drift. Identity and lifecycle governance built for VMs didn't translate. VMware spent years and significant capital trying to bridge the gap, acquiring Pivotal and launching Project Pacific to run Kubernetes on top of VMware infrastructure. The tools could coexist. The governance grammar could not be inherited. Kubernetes required its own access controls, its own identity model for workloads, its own way of scoping what a running process was allowed to touch. A wholly different model for a population running at a different clock speed.
The clock speed was the thing. VMs persisted for months. Containers scaled from zero to thousands in seconds and dissolved after task completion. A governance model that assumed you'd individually track each running entity became either a bottleneck (slowing container orchestration to VM-management pace) or ceremonial (registering containers without actually governing their behavior in real time).
Serverless pushed the clock speed further. Functions that exist for milliseconds, triggered by events, scaled automatically, billed per invocation. The governance grammar shifted again: from managing named entities to managing policies that constrain classes of behavior. The unit of governance became the policy, not the individual instance.
Each transition followed the same arc. The incumbent governance framework was extended to the new population. It worked adequately at small scale. It broke as the population grew and its operational rhythms diverged from what the framework assumed. The resolution was always a new governance grammar native to the new population's clock speed.
Workday already learned this once
The part that makes the pattern concrete rather than abstract: Workday has been through a version of this before, and the resolution was exactly what the infrastructure pattern predicts.
In 2021, Workday acquired VNDLY for roughly $510 million. The reason was instructive: Workday's HCM system couldn't adequately govern contingent workers. Contractors, freelancers, gig workers, people who did work for the organization but didn't fit the "employee" abstraction that Workday's data model was built around. They had different onboarding flows, different compliance requirements, different lifecycle rhythms. As Josh Bersin documented, Workday's HCM was "built on job families, hierarchical job levels, and tens of thousands of job titles, job descriptions, and job competency models." The concept of a contingent job didn't quite fit.
Workday's solution was to acquire a separate system, a Vendor Management System, that governed the contingent population with its own abstractions. The employee governance grammar and the contingent governance grammar coexisted, integrated but structurally distinct.
The lesson Workday learned with VNDLY: governance frameworks hold for the population they were designed for, and a new grammar emerges for the faster one. The integration layer between them becomes the valuable real estate.
ASOR is Workday trying to avoid learning that lesson again. The bet is that agents are close enough to employees that the HR grammar stretches. The VNDLY precedent suggests it won't. Contingent workers were at least human, operating on roughly human timescales, and the employee model still couldn't accommodate them. Agents are faster, more numerous, and more structurally alien to the org-chart model than contractors ever were.
The integration seam
One piece of concrete evidence for how Workday is thinking about the division of labor: the Microsoft Entra Agent ID integration, announced at Workday Rising in September 2025.
The division of responsibility is clean in theory. Microsoft handles identity verification: Entra Agent ID gives each agent a directory object with authentication credentials, OAuth scopes, and audit capabilities. Workday handles business context: ASOR registers the agent against roles, cost centers, permitted actions, and SLOs, making agents visible in workforce and financial analytics.
Microsoft provides the passport. Workday provides the job description. The passport says you are who you claim to be. The job description says what you're allowed to do and why.
Which layer ends up owning the governance grammar as agent populations scale is an open question. Identity verification, whether this agent has permission to access this resource, is a well-understood problem with established patterns. Business context governance, whether this agent should exist, whether it's doing useful work, whether its role still makes sense given how the organization changed since Tuesday, is the harder, less-solved problem. And it's the one where the clock-speed mismatch bites hardest, because "does its role still make sense" is a question HR systems answer on human timescales.
The integration structure reveals something about Workday's own assumptions. By accepting that identity verification lives in someone else's layer while claiming the business-context layer, Workday is betting that organizational truth (who reports to whom, what policies apply, what budget an agent draws from) is more durable and more valuable than the identity plumbing. That bet holds if the business-context layer is where governance decisions actually get made. It weakens if agent populations grow large enough that the identity layer's automated lifecycle management (Entra already supports automated provisioning, least-privilege scoping, and decommissioning of agent identities) starts making governance decisions that the business-context layer merely ratifies after the fact.
If agent populations stay small and their lifecycles stay long, the Workday layer is the governance layer. If agent populations grow large and their lifecycles compress to minutes, the governance grammar that wins will look more like infrastructure orchestration than workforce management. In that world, Workday's "organizational truth" becomes an input to someone else's governance system rather than the system itself.
Where the clock starts ticking faster
The May 2026 launches are interesting precisely because they show the HR metaphor working well at current scale while accelerating toward the conditions that strain it.
Sana for ITSM is elegant in its current form. A new hire in Workday triggers automatic provisioning of accounts, hardware, and software licenses. A departure triggers credential revocation. The agent monitors underlying events and acts proactively: a role change adjusts data access, an employee departure instantly revokes credentials. Workday's Chief AI Officer Joel Hellermark framed the logic: "Workday already holds the organizational truth that makes that possible."
For human-triggered workflows, this is genuinely powerful. The HR system's clock speed matches the event's clock speed. Humans get hired on human timescales. The governance model and the governed population are in sync.
But notice what happens when you extend the logic. If agents themselves are governed by the same system, then agent lifecycle events (instantiation, role change, decommission) need to flow through the same approval and policy infrastructure. An agent spun up in response to a spike in IT tickets doesn't wait for an approval chain designed for human hiring. An agent decommissioned because its task completed three minutes ago doesn't need an exit interview.
Sana for ITSM is expected to reach early adopters in the second half of 2026. The Travel Agent is already in production with early adopters. Both push Workday beyond HR and finance into IT operations and corporate travel. Jerry Ting, Workday's VP and Head of Agentic AI, told SiliconANGLE that "just doing HR and finance, in my view, is not ambitious enough."
The ambition is the accelerant. The further Workday pushes agents into operational territory (IT service management, travel, procurement) the more agents it deploys, the faster the governed population outgrows the governance framework's native rhythm. Agent-driven expansion deals already averaged nearly 50% larger than non-AI transactions in Q4. The commercial incentive is to deploy more agents into more domains. The governance clock ticks at the same speed regardless.
The lens that emerges
Three cases, one pattern.
VMware's governance model worked for VMs because VMs operated at the clock speed the model assumed. When containers arrived at a faster clock speed, the model didn't stretch. A new governance grammar emerged, native to the new population's rhythm. Workday's HCM model worked for employees because employees operated at the clock speed the model assumed. When contingent workers arrived at a modestly faster clock speed, the model didn't stretch. Workday acquired VNDLY and built a parallel governance grammar. Now ASOR's HR-derived model works for agents because agent populations are small enough to manage at human clock speed.
Any enterprise platform that extends human-paced governance to machine-paced populations will hit the same fork: the framework becomes a bottleneck (forcing the new population to operate at the old clock speed, destroying its value) or it becomes ceremonial (registering the new population without actually governing it, destroying the framework's value). The resolution, every time, is a new governance grammar native to the faster clock speed, integrated with but structurally distinct from the original.
Workday's own "work chart" concept is the clearest evidence that the people building ASOR already see this coming. The work chart maps tasks and skills rather than roles and reporting lines. It governs what work gets done at the level of the workflow, not the hierarchy. That's a governance grammar for the faster clock speed, and the fact that Workday is exploring it while shipping the slower one tells you exactly where the internal tension sits.
The prediction
Workday's HR-derived agent governance model will work for the next 12 to 18 months because enterprise agent populations remain small enough to manage at human clock speed. During that window, ASOR's value is real: it provides visibility, accountability, and cost tracking for a population that's still countable.
By the end of fiscal year 2028 (January 2028), Workday will ship a governance model for agents that is structurally distinct from its current org-chart-based approach. It will look closer to the "work chart" concept Arnold described: task-graph-based, organized around workflows rather than reporting lines, with automated lifecycle management that doesn't require human approval for routine instantiation and decommission. The "agent as employee" metaphor will persist in marketing materials and executive keynotes long after the product's operational logic has moved past it for customers with agent populations above a few hundred.
If I'm wrong, the most likely reason is timing rather than direction. I called the last infrastructure governance transition (VM to container management tooling) too early by about two years; the direction held but the timeline didn't. The same risk applies here. The governance clock problem is structural. The only variable is whether Workday builds the new grammar fast enough, or whether a governance layer native to machine clock speed emerges from outside the HCM world and relegates Workday's organizational truth to an input rather than the control plane.
Workday's advantage is that it starts with the organizational data any agent governance system will eventually need. Its disadvantage is that the governance framework it's shipping today was designed for a population that observes Memorial Day.
Things to follow up on...
- ASOR's "work chart" development: Workday's VP of AI Platform described the work chart as an exploratory concept in an April 2026 Diginomica interview, but no product timeline or specification exists yet — worth watching for whether it surfaces at Workday Rising 2026 as a formal product direction.
- Flex Credits rate card economics: Practitioner reporting suggests per-skill consumption rates vary dramatically across agent types, with some actions consuming hundreds of credits per invocation, which would make the governance-versus-revenue tension more acute as agent populations scale.
- Entra Agent ID integration status: Microsoft and Workday announced the ASOR–Entra Agent ID integration in September 2025 at Workday Rising, but the ASOR datasheet notes some integrations remain in development — the division of governance authority between the two layers will become clearer once the integration reaches full production.
- Sana for ITSM early adopter results: Workday's ITSM agent is expected to reach early adopters in the second half of 2026, and the first customer evidence on whether HR-derived approval chains can handle IT-speed agent lifecycle events will be the earliest real test of the governance clock problem.