Workday Data Cloud opens its system of record to AI agents with live data, context and governance

At its Rising event, Workday unveiled the Workday Data Cloud architecture, which opens its System of Record directly to AI agents. According to the company, teams no longer have to extract data, duplicate it or rebuild security: agents work with the same live data, the same business logic and the same permissions that already run operations. The text is a corporate blog post from the vendor itself, so the figures and results it cites are Workday's claims, not independent verifications.

The architecture is organized into four layers. The first is the Open Data Core, which unifies operational and historical data in a foundation of more than 240 pre-curated business objects. The second is data access and processing, with Live Data Query. The third is the Context Layer, which packages encoded business logic. The fourth is Agent-Ready Tools for Data, which route every action through the Workday Agent Gateway.

In terms of availability, Agent Lake and Live Data Query are generally available as of this week. The Context Layer's semantic models and Agent-Ready Tools for Data are in Early Access.

Layer 1, Open Data Core. Workday argues that enterprise architecture has been split between operational systems for live transactions and analytical lakes for historical data, joined by costly, slow ETL processes. Its proposal is to bring both worlds together in a single core. Workday's transactional system is, according to the company, a natively object-oriented Memory Graph that encapsulates data, calculated logic, multi-instance relationships and effective-dated history. The company's argument is that foundation models are highly fluent with language but poorly equipped to handle hierarchies and time, something its graph already understands.

On the analytical side, Workday places more than 240 pre-curated business objects (including Worker, Position, Cost Center, Purchase Order and General Ledger Account) in the open Apache Iceberg format within its Agent Lake. That data can be federated, zero-copy and bidirectionally, to Google BigQuery, Salesforce Data 360 and Snowflake, which are already generally available, and to Databricks and Amazon SageMaker, which are in Early Access. The company says it processes more than 500 trillion rows of HR and finance data every month (the figure as given in the English original) and integrates more than 229 billion rows of external data into its lake.

The text includes a quote attributed to a data solutions lead at a customer, who describes Workday as one of the "three legs of a stool" at their company and says Data Cloud extends its value by enabling report-based integration at scale.

On security, Workday criticizes the fact that most data lakes force organizations to set up a second permissions system disconnected from the one that already governs data inside Workday. Its alternative is Contextual Security on Agent Lake, which restricts access based on each person's specific relationship to the data, not on their role. The example it gives: a regional HR director sees their region, while a compensation manager sees their pay band across all regions; the same object produces two different, correct answers. The company says it extends that model, already configured by customers, to analytical and agentic workloads on the lake.

Layer 2, access and processing. Live Data Query, now generally available, routes each query simultaneously across live operational state and the Agent Lake, with sub-second latency and no ETL. It is a distributed execution layer built on the open-source Trino engine, which isolates execution workloads so that a massive BI dashboard or an analytical agent does not compete with the core's transactional performance. Access points expose standard JDBC, native BI connectors and Model Context Protocol (MCP) interfaces. According to Workday, it applies unified security policies at the query layer and avoids batch extraction and replication. As an example, analysts can run Power BI or Tableau dashboards live against Workday's transactional state under native permissions.

Workday says its early users ran more than 1,645 live queries across Databricks, Snowflake, Power BI and Tableau during the first three months. According to the company, they were two to three times faster than legacy extraction via RaaS (Workday's reports-as-a-service mechanism), and they were able to run queries that previously failed due to earlier limitations.

Layer 3, Context Layer. Workday argues that trying to fix AI hallucinations by pointing models at raw query logs, or by stuffing complex business relationships into a prompt, is doomed to fail. It cites recent findings from frontier AI researchers according to which the bottleneck for analytical agents is not access to historical data but structural understanding. The text does not specify which study this is.

The Context Layer, the company says, encodes 20 years of enterprise domain expertise and offers a predefined, deterministic model that LLMs and agents query through MCP endpoints. In doing so, it claims, it prunes prompt context, reduces token consumption and eliminates hallucinated metrics. The line that sums up the idea: security tells the agent what it can see; semantics tells it what things mean.

In Early Access are preconfigured finance and HCM semantic models. They are not auto-generated schemas; rather, they package the KPIs, dashboard logic and encoded business rules that already reside in the transactional Memory Graph. They cover objects such as Headcount, Cost Centers and Voluntary Turnover. Workday adds that, at Rising, it made out-of-the-box semantic models available for common HCM and finance objects for agent development in Workday. Because they rest on the same governed platform customers use to extend them, organizations can create custom versions, and those "tenanted" models automatically inherit existing security and business logic.

The practical promise is that any agent, whether from Workday, the customer or a third party, uses a single, auditable definition of metrics such as turnover or headcount. The example in the text: the question "what is our regrettable turnover rate for people managers in EMEA this quarter?" would return the same answer from any agent and tool, because the definition of "regrettable turnover," the organizational hierarchy and the effective-dated quarter boundaries live in the semantic model, not in a prompt.

Layer 4, agentic experiences. Workday posits that data and context tell an agent what is true, but not what it is allowed to do or who is accountable if something goes wrong. To that end it is introducing, in Early Access, Agent-Ready Tools for Data, exposed through standard MCP. They offer dynamic schema discovery, automated data orchestration, dataset lifecycle management, and governed ingestion and extraction.

Every agent tool call passes through the Workday Agent Gateway, which enforces runtime authorization, rate limiting and business policy limits. In addition, each agent's identity, skills and execution logs are registered in the Workday Agent System of Record (ASOR) via Agent Passport, a governance and security tool for testing, verifying and continuously monitoring agents before and during deployment.

According to the company, agents run under explicit user delegation. If an autonomous agent attempts an action that exceeds the set limits, such as spending caps or regional policy rules, the platform routes the request to a human-in-the-loop approval flow or executes stateful transaction rollback protection. Workday adds that partner-built applications are not a side door to the data; they are subject to the same governance as everything else that operates against the System of Record.

Key takeaways. Workday's position is that the value for enterprise agents lies not just in accessing data but in three things at once: live data without copies, consistent business meaning, and governed actions with traceability. It is also a bet on open standards (Iceberg, Trino, JDBC, MCP) and on zero-copy federation to the most widely used third-party data platforms. On the other hand, the text is promotional material published during the Rising event: the speed improvements, token reduction and elimination of hallucinations are presented without methodology or comparative data, and much of the context layer and the agent tools remain in Early Access, so their real maturity has yet to be proven.