Workday, which runs HR and finance for thousands of companies, is letting other AI tools do real work inside its system. An employee will be able to ask Claude, Microsoft Copilot, Google's Gemini Enterprise, Slack or Teams for something in plain words, and Workday's agent Sana will check the company's rules and then carry the task out. Workday keeps the permissions, the approvals and the audit trail.
The tools could already answer; now they act
Employees could already ask Workday questions from inside most of those chat tools. The change is that Sana now finishes the task instead of explaining how to do it. After a business trip, for example, it can notice an expense you never filed, apply the company's policy and prepare the report, and you confirm it from the conversation. Sana in Claude is open to early users now, and it is planned for the other tools in late 2026.
Companies that build their own agents get a second door. Workday's tools for any assistant that speaks the common MCP standard are now generally available. MCP works like a standard plug: any assistant that has it can call the actions a system chooses to offer. Every call carries who is asking, what that person may see and do, and which approvals apply.
The rule has to live outside the model
It is tempting to paste the leave policy into the assistant's instructions and trust it to follow them. That does not work as well as it sounds. When Workday's engineers gave models a policy and asked questions the policy could not settle, the models noticed the gap in only one case in four. The rest of the time they answered with confidence, and in some cases they invented a rule to justify the answer.
Now picture a manager who asks an agent to move someone into a role the manager has no authority to fill. If the rule is only in the prompt, the agent may reason its way to a plausible yes. If the rule is a permission in the system, the request is refused before any reasoning happens, because a permission check does not weigh arguments. So Workday puts the rulebook between the chat tool and the data: the model can be wrong, and the system still holds.
Whoever keeps the rules keeps the customer
In British banking, other companies built the screens and the bank kept the ledger and the rules. Workday is choosing that position on purpose. The assistant companies will own the habit of asking, and Workday is counting on the rules and the record being worth more than the screen. The same will happen to payroll, scheduling and accounting software. Within a few years, the question for a shop owner or a department head will not be whether a product has an AI feature. It will be whether the product lets any assistant act on it under the owner's own permissions.
The saving is easy to estimate. A company of 2,000 people where each person asks HR or IT for one routine thing a month, and each ticket takes a helpdesk worker ten minutes, spends about 330 hours a month on them. That is two full-time jobs, and most of it is the kind of request an agent can settle in seconds.
The screen used to hide a risk. A wrong job title or an out-of-date reporting line in the system now becomes a wrong permission, applied instantly from a chat window. The agents are only as good as the record underneath them.
So before connecting any assistant to payroll, HR or accounts, ask where the approval limit is enforced. If the answer is that it is written in the instructions, it is a suggestion. If it is a permission in the system the assistant has to go through, it is a rule.