For about fifteen years, enterprise identity governance has been a largely solved problem. Not elegant, not simple — but solved. SAML handles federated authentication. SCIM handles automated provisioning and deprovisioning across applications. LDAP or its cloud successors hold the directory. When a new hire joins, one system creates the identity and pushes it everywhere. When someone leaves, one system revokes access and pulls it back. The enterprise has a single audit trail, a single point of control, and a single answer to the question every CISO eventually asks: who has access to what, right now?
Workday's May 2026 rollout of AI agent role provisioning inside Illuminate is the clearest early signal that this solved problem is about to become unsolved. Workday didn't make a mistake. It made the rational move, and the rational move for a platform of Workday's depth is almost always to keep things inside the platform.
That's the argument I want to build here: the silo Workday just created is coherent, well-designed, and genuinely useful to customers in the short term. The same properties that make it useful now are what make it a structural liability later. And the conditions under which an enterprise decides the liability outweighs the convenience are specific enough to name.
What Workday Actually Did
The details carry the argument, so it's worth stating the mechanics precisely.
Illuminate's agent role provisioning assigns AI agents — the kind that assist with HR workflows like headcount planning, offer letter generation, and benefits administration, or finance workflows like expense categorization, invoice processing, and variance analysis — role-based access credentials that mirror the access model Workday already uses for human workers. An agent handling compensation review gets a role that looks like a compensation analyst's role: read access to salary bands, write access to draft recommendations, no access to payroll execution. An agent processing invoices gets the access profile of an AP clerk.
The provisioning, the role definitions, the access policies, and the audit logging all live inside Workday's own identity and access framework. Workday manages the agent lifecycle — creation, modification, suspension, deletion — through the same administrative surfaces that HR administrators already use to manage human worker access. From the customer's perspective, this is a single pane of glass: one place to see what every agent and every human can do inside Workday.
What it is not: any part of the enterprise's existing identity infrastructure.
- The SCIM directory doesn't know these agents exist.
- The identity governance platform that tracks privileged access across the enterprise doesn't see them.
- The unified audit log that the security team queries when something goes wrong has no record of them.
They exist in Workday's world, fully and coherently, and nowhere else.
The Puzzle
The obvious read is that Workday is doing the sensible thing. Workday understands the business process logic of HR and finance better than any generic identity provider. Assigning an AI agent the right access for a compensation review workflow requires knowing what a compensation review workflow actually involves — which data objects matter, which approval chains exist, which actions should be gated behind human confirmation. Workday has that knowledge baked into the platform. A generic identity system doesn't.
So the sensible read is: Workday is drawing on its process depth to build a better access model for AI agents than any external system could. Customers get agents that work correctly, with access that's calibrated to the workflow, managed through a familiar administrative interface. What's the problem?
The problem is that "sensible for Workday" and "sensible for the enterprise" are the same thing right now, and they won't be in three years. The question I want to spend this piece answering is: what does Workday's structure force it to do, and what does that force eventually cost the enterprise?
The Chain
Start with Workday's incentive structure, because that's what determines the architecture.
Workday's revenue model is subscription-based, with contract values that correlate strongly with the depth of platform adoption. The more workflows a customer runs through Workday, the more modules they've licensed, the more their operational processes are entangled with Workday's data model — the higher the switching cost and the more durable the revenue. This is not a secret; it's the explicit logic of Workday's go-to-market, visible in every earnings call discussion of "platform expansion" and "wallet share."
AI agents, in this context, are not just a product feature. They are a switching cost accelerant. An enterprise that has deployed Workday AI agents to handle headcount planning has now embedded Workday's judgment — its access model, its workflow logic, its data structures — into an automated process that runs continuously. Ripping out Workday now means not just migrating a database but re-provisioning and re-validating every agent that touches HR data. The agents are the stickiness.
Given that logic, keeping agent identity inside Workday's own framework is not a product oversight. It's the correct product decision. Every agent identity that lives inside Workday's framework is an identity that cannot be managed, audited, or revoked from outside Workday. That's a feature from Workday's perspective: it makes the platform more essential, not less, as agent deployments scale.
The customer's incentive in the short term is also aligned with this architecture. Deploying AI agents inside Workday's access framework is genuinely faster and lower-friction than integrating with external identity governance infrastructure. The process fidelity is real — Workday's role definitions actually map to the workflows the agents are executing. The administrative interface is familiar. The audit trail, within Workday's world, is complete. For an enterprise that wants to get agents into production quickly, the path of least resistance runs directly through Workday's framework and nowhere else.
And yet.
The enterprise is not deploying AI agents only inside Workday. The same enterprise that has Workday agents handling headcount planning also has agents in its ERP handling procurement, agents in its CRM handling pipeline forecasting, agents in its IT service management platform handling ticket triage. Each of those platforms, following exactly the same product logic as Workday, has built its own agent identity framework. Each framework is internally coherent. None of them talks to the others.
The enterprise now has a parallel identity plane for AI agents that is fragmented across every application that has shipped an agent capability. The human identity plane — the one governed by SCIM and SAML and the enterprise's identity governance tooling — is unified. The agent identity plane is not. It is N separate silos, each coherent in isolation, each invisible to the others.
The governance problem this creates is not abstract. When the enterprise's security team needs to answer a routine question — which AI agents currently have access to compensation data? — in the human identity world, that query runs against one system and returns a complete answer in seconds. In the agent identity world, the security team has to query Workday's administrative console, plus every other platform that might have agents touching compensation-adjacent data, manually reconcile the results, and hope that the role definitions across platforms are comparable enough to mean the same thing.
Now consider a harder question: an agent produced an incorrect compensation recommendation that was acted on before human review caught it. Which agent? What access did it have? What did it do, in sequence, and when? In the human identity world, the unified audit trail answers this. In the agent identity world, the answer lives inside Workday's audit log, which is complete for everything that happened inside Workday and silent about everything that happened anywhere else.
The blast radius of any individual agent incident may be contained within a single platform. The governance problem is not about blast radius. It's about the enterprise's ability to reason about its agent population as a whole — to know, at any moment, what every agent can do, what every agent has done, and how to revoke access across the entire population when something goes wrong. That capability requires a unified identity plane. Workday's architecture, rationally, does not provide one.
The Last Time Enterprise Identity Fragmented
This is not the first time enterprise software vendors have created parallel identity planes that made sense in isolation and created governance problems at scale. The SaaS transition of the mid-2000s through mid-2010s ran the same pattern, and it's worth tracing because the resolution tells you something about how this one ends.
Before SCIM became a standard (the protocol was finalized in 2015, with meaningful enterprise adoption following over the next several years), every SaaS application managed its own user directory. Salesforce had its own user store. Workday had its own user store. Every application had its own. When a new employee joined, IT provisioned them in each application separately. When someone left, IT deprovisioned them in each application separately — or, more commonly, forgot to deprovision them in two or three applications and created a security exposure that persisted for months.
Each application's identity management was internally coherent. Salesforce's user model was well-designed for Salesforce's workflows. Workday's user model was well-designed for Workday's workflows. The problem was not that any individual application was poorly designed. The problem was that the enterprise had no unified view, no single point of revocation, and no audit trail that crossed application boundaries.
The resolution wasn't for each application vendor to build better internal identity management. Identity became a separate layer, governed by a separate system, with each application consuming identity from that layer rather than owning it. SCIM is the provisioning protocol that made this possible. The enterprise identity governance market built the tooling on top of it.
The resolution took roughly a decade from the emergence of the problem to widespread adoption of the solution. The forcing function was not a single incident but an accumulation of audit findings, compliance requirements, and security exposures that made the cost of fragmentation visible and attributable.
AI agent identity is running the same pattern, compressed. The fragmentation is happening faster because agent deployment is happening faster. The governance gap is larger because agents act autonomously and at machine speed, which means the window between a misconfiguration and a consequential action is shorter than it is for human users. And if the logic holds, the resolution is not for Workday to build better internal agent identity management. Agent identity becomes a separate layer. The question is how long it takes for the enterprise to see the cost clearly enough to demand one.
The Coherence Trap
The pattern has a name, and naming it makes it easier to recognize the next time.
A platform's internal logic is so well-designed for its own domain that it solves the immediate problem completely — which is exactly why the enterprise stops asking whether the solution belongs inside the platform at all.
The trap is not that the platform does something wrong. It's that the platform does something right, and the rightness of it forecloses the question of whether the correct architecture is a platform-local solution or a cross-platform layer.
The Coherence Trap has a specific signature. The platform's solution is genuinely better than any generic alternative for the platform's own workflows. The customer adopts it because the friction of the alternative is real and the benefit is immediate. The cost of the silo stays invisible until the enterprise has deployed enough similar silos that the coordination problem surfaces. By then, the switching cost is high — not because the platform has done anything to lock the customer in, but because the customer has built operational processes on top of the silo's architecture.
This is not a monopoly story and doesn't require bad intent or anticompetitive behavior. It requires only that a well-designed platform follow its own product logic to its natural conclusion. The trap is structural.
Workday's agent identity framework is a textbook instance. The framework is well-designed, the process fidelity is real, the customer benefit is immediate, and the silo cost is invisible today and will compound as agent deployments proliferate across the enterprise's application portfolio.
The Forces That Complicate This
The argument above has a clean logic, and clean logic in enterprise software analysis is usually a sign that something important is being left out. A few forces complicate the picture in ways that matter.
The most obvious: Workday could open the framework. Nothing in the architecture prevents Workday from exposing agent identity data via a SCIM extension or equivalent API, allowing enterprise identity governance platforms to read agent roles, access policies, and audit events from Workday's system. This would dissolve the silo without requiring a separate identity layer. The question is whether Workday's incentives support this, and my read is that they support a partial version of it — read-only access, with Workday as the authoritative system of record — but not the full version, where external systems can write to Workday's agent identity framework. The silo gets a window before it gets a door, and the window preserves the governance problem even as it appears to address it.
The second complicating force: the silo may never matter if agent deployments stay concentrated within Workday's domain. If an enterprise's AI agents are primarily handling HR and finance workflows, and those workflows live primarily inside Workday, then the blast radius of any agent incident is contained within Workday's own audit trail. The multi-silo governance problem only materializes when agents proliferate across multiple platforms. If enterprise AI agent adoption is slower and more concentrated than current projections suggest, the problem may not become visible for longer than the argument implies.
The third force is regulatory. The EU AI Act's requirements around AI system documentation and risk management, which came into force in stages through 2025 and 2026, require enterprises to maintain records of AI system capabilities and access controls. An enterprise with agent identity fragmented across N platform silos has a documentation problem that no single platform can solve. Regulatory pressure may force the cross-platform identity layer into existence faster than market pressure alone would. The EU AI Act doesn't specify the architecture, but the audit requirements create a strong incentive for enterprises to demand a unified view — and to push platform vendors to provide one.
The fourth force is the pace of the transition itself. The SaaS identity fragmentation problem took a decade to resolve partly because the adoption curve was gradual enough that the governance gap accumulated slowly. AI agent adoption, if the current trajectory holds, is moving faster. That could mean the governance problem becomes visible sooner, which accelerates the forcing function. It could also mean enterprises are deploying agents before their governance frameworks are ready, which means the first major incident involving a misconfigured agent happens sooner than the market expects.
The Prediction
By the end of 2027, Workday will ship an API that exposes AI agent role assignments and audit events to external identity governance platforms. The API will be read-only: external systems can query what Workday's agents can do and what they have done, but they cannot write to Workday's agent identity framework. Workday will position this as an enterprise integration capability and a response to customer demand for unified visibility. The architecture will ensure that Workday remains the authoritative system of record for agent roles — the external system can see the silo's contents but cannot govern them.
The trigger: at least one publicly disclosed governance incident involving a Workday AI agent with misconfigured access, in which the enterprise's security team could not reconstruct the agent's actions from their existing audit infrastructure and had to rely entirely on Workday's internal logs. That incident, whenever it occurs, will make the governance gap visible and attributable in a way that internal IT arguments about identity architecture cannot. It will also give Workday's enterprise customers the political cover to push for the API that Workday's product team already knows is coming.
What the read-only API does not solve: the enterprise still cannot revoke agent access across all platforms from a single point. It still cannot write a unified policy that governs agent access consistently across Workday and every other platform that has shipped agent capabilities. The silo has a window. The governance problem persists.
The Coherence Trap does not resolve when the platform adds an API. It resolves when the enterprise decides that agent identity belongs to a layer that no single platform owns. That decision requires organizational pressure that hasn't fully built yet — a combination of audit findings, compliance requirements, and at least one incident that makes the cost of fragmentation concrete and attributable.
Workday's May 2026 rollout is not that incident. It's the architecture that makes the incident possible.
The SaaS identity transition took roughly a decade from the emergence of the fragmentation problem to widespread adoption of the cross-platform solution. The AI agent identity transition is running faster, on a more complex substrate, with higher stakes for autonomous action. If the pattern holds, the forcing function arrives sooner than the market currently expects — and the platform that built the most coherent silo will face the most pressure to open it.