What Workday AI agents are, and where Illuminate fits
Workday Illuminate is the name Workday gives its AI layer, and Illuminate agents are the role-based agents Workday builds itself: the Recruiting Agent, Payroll Agent, Financial Audit Agent, Business Process Optimize Agent, Talent Mobility Agent and, announced at Workday Rising on 16 September 2025, the Cost and Profitability, Financial Close and Financial Test agents for finance teams. Workday said the September 2025 wave would reach customers during 2026.
The second group is everything that is not built by Workday. Workday announced the Agent Partner Network and an Agent Gateway on 3 June 2025 so that agents from Accenture, AWS, Google Cloud, Microsoft, PwC, Salesforce, IBM, Glean, Auditoria.AI and others can connect to Workday over MCP and A2A. Workday now counts more than 65 partners connecting agents, plus nearly 20 Workday Ventures portfolio companies selling agents on Workday Marketplace.
Both groups land in the same place: the Workday Agent System of Record, announced on 11 February 2025 and generally available from February 2026. If you are evaluating Workday AI agents, ASOR is the object that decides what an agent is allowed to touch, so it is the thing worth reading closely.
What the Workday Agent System of Record governs
Workday describes ASOR as one place to onboard agents, assign owners and roles, apply security, track cost and measure value, with the same discipline Workday already applies to people. That is a real control plane for identity and access, and it is further along than most HR and finance vendors.
In the API itself, an agent is created from an A2A Agent Card. The POST /agentDefinition operation, secured by the domain "Setup: Agents", takes the card's name, provider, version, capabilities and skills, then records which Workday resources and tools the agent may use. Each skill carries an executionMode of Ambient or Delegate, and each resource is tied to secured_items, Workday's security domains. There are flags for mcpEnabled and httpEnabled, and fields for an external agent ID and external tenant, which is how a partner agent living on AWS or Google Cloud gets its Workday identity.
So ASOR answers who the agent is, what it can see and which Workday operations it can call. It does not answer how much money it can move.
We measured the ASOR API: 101 properties, zero money fields
Workday publishes an OpenAPI file for every public REST service in its REST Directory on community.workday.com, readable without a login. On 22 September 2026 we downloaded asor_v1, the Agent System of Record service, from the build dated 19 September 2026, and scanned every property in every definition, including the ones nested inside allOf blocks.
The service has 6 operations (create and read agent definitions, search agent resources, read registrations), 38 definitions and 101 properties. A money regex (amount, currency, budget, spend, price, cost, payment, invoice, limit, purchase, fund) matched 0 of them. A second pass for scope (supplier, vendor, merchant, category, approval, threshold, daily, monthly, cumulative, payee) also matched 0.
We then read the ASOR changelog Workday publishes alongside the spec. It lists 7 releases, from v2025.50 on 15 December 2025 to v2026.33 on 17 August 2026, with 16 changes between them: new operations, edited descriptions, a modified endpoint. None of the 16 introduces a money word.
Two controls keep this honest. First, the regex is not blind: the same pass on Workday's accountsPayable_v1 matched 29 properties (amount, controlTotalAmount, currency, taxAmount, unitCost, paymentTerms), procurement_v5 matched 51, and budgets_v1 matched 7, including availableAmount and spendAmount. Second, Workday is not a catch-all server: a made-up file name in the same directory returned HTTP 404. Across all 87 public REST services the pass found 497 money properties in 43 services. The agent registry sits with the 44 services that have none, next to holidays, skills and learning.
Where Workday already controls money, and where agents slip past it
Credit where it is due. When an agent works through Workday documents, Workday's controls apply to the agent exactly as they apply to a person. A requisition created through POST /requisitions runs the same business process, with the same approval chain and the same budget check (POST /runBudgetCheck in the Budgets API). A supplier invoice request submitted through Accounts Payable meets your invoice approvals. An expense report submitted through the Expense API meets your expense rules. If your Workday agents only create documents and hand them to business processes, you are covered, and you should not buy anything else yet.
The gap is spend that never becomes a Workday document. ASOR has httpEnabled and mcpEnabled flags because partner agents act outside Workday: a sourcing agent that buys a data subscription, a travel agent that books a flight on a card, a coding agent that pays for API calls, an agent that settles in USDC over x402. That money never touches a requisition, so it never reaches the approval chain or the budget check, and the only record Workday holds of the agent has no field to put a limit in.
What Workday AI agents cost: Flex Credits
Workday sells agents through Workday Flex Credits, announced on 16 September 2025. Credits are bought in bulk as an annual subscription and consumed when an agent completes a task in production. Workday's own example: the Self-Service Agent uses 1 credit per instant information retrieval and 5 credits per autonomous task completion. Customers get a complimentary annual allotment sized to the company, and a Platform Consumption Console warns when the balance runs low.
Workday has not published a rate card or a dollar price per credit. Consultancies tracking the model report a range of 1 to 750 credits per action and API usage metered at 60 credits per 10,000 calls, with overage billing starting 1 February 2027; treat those as secondary until Workday confirms them in your order form. We break the numbers down in our Workday Flex Credits pricing guide.
Notice what the meter measures: agent work, billed by Workday. It says nothing about the money an agent spends on someone else. A 5-credit task that books a 4,000 dollar flight costs you 5 credits on the Workday invoice and 4,000 dollars on a card.
Workday AI agents rollout checklist for finance and HR leaders
Before you switch on Workday AI agents, or approve a partner agent in the Agent System of Record, run through six questions. Most teams can answer the first four from Workday alone.
- Who owns the agent? Every agent in ASOR should have a named owner, the same way a worker has a manager. If nobody will answer for it, it should not be registered.
- Which security domains does it hold? Review the
secured_itemson each resource. An agent that only needs to read supplier data should not hold a domain that lets it submit supplier invoices. - Ambient or Delegate? Check the execution mode per skill, and decide which skills may run without a person in the session.
- Does every money action become a document? If the agent creates requisitions, supplier invoice requests or expense reports, Workday business process approvals and budget checks cover it. Write that down as the control.
- Is
httpEnabledormcpEnabledon, and what is on the other end? If the far end can charge a card, move funds, buy a subscription or settle a stablecoin payment, the amount is outside Workday. - What is the most this agent can spend in a month, and who approves above it? If the honest answer is "whatever the card limit is", you need a per-agent budget and an approval threshold before go-live.
Auditors will ask the sixth question in the first review after agents go live, because it is the one SOX-minded teams already ask about people with purchasing cards. Having the answer in writing, with a system that enforces it, is the difference between a clean finding and a remediation plan.
How to put a spending limit on a Workday AI agent
Keep Workday as the system of record for who the agent is and what it may read. Put the money somewhere that can refuse a payment. With AgentsPay each agent registered in ASOR gets its own budget across a day, a week and a month, a merchant-locked virtual card or wallet, an approval threshold that routes anything above it to a named person, and a payment-level audit trail you can reconcile against Workday Financials. The limit is checked before the payment, not reported after it.
The pattern is the same one we measured at Oracle AI Agent Studio, ServiceNow AI Control Tower and Microsoft Agent 365: the platform governs identity and access in depth and leaves the amount to whoever holds the payment rail. For the policy side, see how AI agent spend controls and approval thresholds work, or pick a plan and cap your first Workday agent before it makes a payment.
This pattern repeats across every enterprise agent platform we have measured, with one instructive variation. UiPath does ship a policy check named budget, which sounds like the exception, and its three settings all count tool calls rather than dollars. Our UiPath agentic automation spend controls breakdown has the measurement.