Workday to acquire C1.ai, formerly ConductorOne, to govern agent access
Workday signed a definitive agreement to buy C1.ai, the access governance vendor that renamed itself from ConductorOne in April. Price undisclosed, close expected by January 31, 2027. The plan is to tie access for people and AI agents to Workday's HR lifecycle.
Workday announced at its Workday Rising event on October 13 that it has signed a definitive agreement to acquire C1, the access governance company that rebranded from ConductorOne in April 2026. Neither side disclosed a price. The deal is expected to close in Workday's fourth fiscal quarter of 2027, which ends January 31, 2027, subject to customary conditions. C1 connects to email, CRM, code repositories, finance systems and cloud infrastructure, grants a person or agent access when needed and removes it afterwards, with policy, human approval and an audit record. Workday says it will extend its Agent System of Record, which already registers agents, so it also governs what those agents can reach inside and outside Workday, and will join onboarding, role-change and offboarding access into one automated flow.
Why it matters
The HR system is already the source of truth for joiners, movers and leavers in most IGA deployments. Workday owning the governance layer as well collapses that integration, and it applies the same lifecycle to agents: an agent retired in Workday loses its access. That is the right control for agent sprawl, as our AI agent identity guide argues.
The open question for current C1 customers is neutrality. Workday's release says nothing about customers whose HR system is not Workday, or about C1's connectors to competing HR platforms. Until close, treat C1 as a live product with a new owner and ask for roadmap commitments in writing at renewal. The IGA buyer guide and the acquisitions tracker cover the alternatives.
Related on Start with Identity
- BlogSnowflake buys Natoma for about 110 million dollars to govern agent access to data
A two-year-old company with 27 people and a 7 million dollar seed round sold for roughly 110 million. What Snowflake bought is a verified MCP server library and
- BlogServiceNow closes its Veza acquisition at about 1.2 billion dollars
Announced in December 2025 and closed on 2 March 2026, substantially in cash. Veza, valued at 808 million dollars in its Series D, now supplies the permission g
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a
- GlossaryAccess Certification
Periodic review of who has access to what, with managers or resource owners attesting that access is still appropriate. A regulatory requirement in many industr
- GlossaryCIEM
Cloud Infrastructure Entitlement Management. Tools that discover and right-size identities and permissions across AWS, Azure, and GCP, reducing excessive and un
- GlossaryEntitlement
A specific permission or right an identity holds over a resource. Governance and CIEM exist to keep entitlements understood, justified, and minimal. Entitlement