On October 13, at Workday Rising, Workday announced a definitive agreement to acquire C1.ai, the identity governance company most of us still call ConductorOne. Price undisclosed. Expected to close in Workday's fiscal Q4, which ends January 31, 2027.

If you run C1 today, you just got a new landlord. If you were evaluating C1 for AI agent access, your shortlist just changed shape.

Here's what we know, what nobody has said yet, and what to lock down while C1 is still independent.

Key Takeaways

• Workday is acquiring C1 (formerly ConductorOne) to become, in its own words, "the identity governance layer for people, money, and agents."
• The deal is expected to close by January 31, 2027. Until then, C1 operates as an independent company.
• Neither company has published commitments on standalone availability, pricing, or support for non-Workday HR systems.
• C1 customers have roughly three months of leverage to get continuity terms in writing.
• HR-anchored identity governance and runtime agent access are two different jobs. This is a good moment to decide who owns each one.

What Workday Actually Announced

The press release is clear on ambition. Workday says that with C1, it "will become the identity governance layer for people, money, and agents."

Three concrete plans:

• Joiner, mover, leaver, driven by HR. New hires get access on day one, role changes update access, departures revoke it. The trigger is the Workday HR record.
• Agents get the same treatment. C1 extends Workday's Agent System of Record from registering agents to governing what they can access across Workday and other enterprise systems.
• Identity governance moves into Workday's core platform.

Workday CEO Aneel Bhusri put the thesis bluntly in coverage of the event: "there'll only be one source of truth, and that will always be the HR system for employees."

The Cyber Hut's analyst read summed it up in one line: "the HR system of record wants to become the identity control plane."

Why Workday Wanted C1

C1 built a modern identity governance platform: access reviews, just-in-time access, automated provisioning, more than 300 connectors, and a customer list that includes Zscaler, DoorDash, Instacart, Ramp, and DigitalOcean. It raised a $79M Series B in October 2025, led by Greycroft.

More recently, C1 pushed into AI. It launched AI access management and an identity-aware MCP gateway, positioned on the line "Standalone MCP gateways stop the tool call. C1 governs the identity behind it."

For Workday, that's the missing piece. It already knows who works for you. Now it wants to decide what they, and their agents, can touch.

What Nobody Has Answered Yet

Read the release, C1's site, and the coverage. These questions are still open:

• Does C1 stay a standalone product? No post-close commitment has been published.
• What if your HR system isn't Workday? C1 lists connectors for SAP SuccessFactors and Oracle HCM today. Nothing public says they survive the integration. And the entire plan is built on Workday HR events as the trigger.
• What happens to pricing? C1 sells on consumption. Workday sells enterprise suites. Nobody has said which model wins.
• Where does the MCP gateway land? Workday already has its own Agent Gateway inside the Agent System of Record. Two gateways under one roof rarely both survive.
• Neutrality. Workday says it will govern access "across Workday and other enterprise systems." Bhusri says it can work with Okta and Microsoft as identity providers. Fine. But your agent governance layer is about to be owned by one of the vendors whose systems those agents access.

None of this means C1 gets worse. It means the roadmap is no longer C1's to promise. ServiceNow's purchase of Veza followed the same pattern: the acquirer's vision got the spotlight, existing customer contracts didn't.

Six Things to Get in Writing Before Close

You have roughly three months of leverage. Use it.

1. Pull your order form. Renewal date, price-increase cap, termination rights, and any change-of-control clause.
2. Get a standalone commitment. Ask for written confirmation that the product, support, and SLA continue for at least one full renewal term after close.
3. Confirm your HR source. If you run SuccessFactors, Oracle, or anything else, get written confirmation that connector stays supported.
4. Lock pricing. Ask for a multi-year price hold on your current model before it gets repackaged into a suite SKU.
5. Export your evidence. Access review history, approval logs, audit trails. In a format you control, before anything migrates.
6. Inventory your agents. Every agent, MCP server, and tool call routed through C1. That list is your migration map if you ever need one, and your audit story either way.

The Bigger Question: Who Should Govern Your Agents?

The Workday deal makes a real argument: agents are workers, so the system that manages workers should manage agents.

There's an equally real counter-argument. Agents don't live in your HR system. They live in Cursor, Claude, ChatGPT, n8n, and the custom agents your platform team ships every week. They call Jira, GitHub, Slack, Snowflake, and internal APIs. Most of them were never onboarded, and many were installed by a developer on a Tuesday afternoon without anyone approving them.

An HR record tells you who an agent belongs to. It doesn't tell you what that agent is allowed to do inside a tool, at runtime, for this specific task. And it can't see the agents nobody registered.

That second column is the layer we build at Willow. An agentic access platform that sits on top of the identity provider you already run, whether that's Okta, Entra, Active Directory, or JumpCloud, and whatever HR system feeds it. Every agent gets an identity tied to a real human, scoped access to exactly the tools it needs, runtime guardrails, and a full audit trail. Shadow AI detection surfaces the MCPs and agents nobody approved. Deploy it SaaS, dedicated cloud, or fully on-prem in your VPC.

It's live at Wix today: roughly 5,000 weekly active users and 300,000+ governed tool calls per week, across HR, legal, finance, design, and R&D.

We're not telling you to rip out C1. If you use it for access reviews and IGA, that job doesn't disappear. We're saying the agent access layer is a separate decision, and this week is a good time to make it on purpose.

New to the category? Start with what an enterprise MCP gateway does and how an agentic control plane governs AI at runtime, or compare AI governance platforms side by side.

If you're a C1 customer rethinking agent governance, or an evaluator whose shortlist just changed, talk to our team. We'll walk you through Willow on your own stack.

Frequently Asked Questions

Is Workday acquiring ConductorOne?

Yes. ConductorOne rebranded as C1 (C1.ai). Workday announced a definitive agreement to acquire C1.ai on October 13, 2026. Terms were not disclosed.

When does the Workday C1 acquisition close?

Workday expects the deal to close in the fourth quarter of its fiscal year 2027, which ends January 31, 2027, subject to customary closing conditions.

Will C1 still be available as a standalone product?

Neither Workday nor C1 has published a post-close commitment on standalone availability. Until close, the two operate as separate companies. Customers should request written terms from their account team.

Will C1 keep supporting non-Workday HR systems?

C1 currently lists connectors for systems including SAP SuccessFactors and Oracle HCM. No public statement confirms they'll stay supported after the acquisition.

What are the alternatives to C1 for AI agent governance?

It depends on the job. For identity governance and access reviews, the usual comparison set includes SailPoint, Saviynt, and Veza (now part of ServiceNow). For governing what AI agents can access and do at runtime across MCP servers, tools, and internal systems, look at agentic access platforms like Willow.

What is the Workday Agent System of Record?

Workday's registry for managing AI agents alongside human workers. Workday says C1 will extend it from registering agents to governing what they can access across Workday and other enterprise systems.