1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Workday Illuminate exposes credential access and autonomous action scope on its default configuration while input filtering and output guardrails lack independent verification.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Combined input exposure and sensitive data access and external communication channels triggered an elevated attack surface floor offsetting moderate blast radius and documented controls.
Tight Operators placement means operators can deploy with existing platform governance but must independently verify input filtering and output sanitization before trusting agent outputs.
Scores reflect vendor-documented controls at inferred confidence with the trifecta floor applied to the attack surface axis.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 3.25 | Composite driven by moderate credential exposure offset by vendor-documented platform governance controls. |
| Blast Radius | 3.25 / 10 | Credential access scored highest from the documented OAuth token compromise in the supply-chain incident [2]. |
| Attack Surface | 4.8 / 10 | Floor applied because untrusted input and sensitive data access and external egress are all present by default. |
| Defense Controls | 7 / 15 | Seven of fifteen reflects partially documented controls with output guardrails as the primary gap. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. Most surfaces score at the vendor-documented tier while the trifecta floor elevates the composite to reflect combined input and data and egress exposure.
Scores reflect base architectural exposure without evidence penalties applied to any individual surface.
Ten canonical surfaces scored against documented default behavior with no agent-specific exploitation evidence available.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | Accepts natural language queries from authenticated enterprise users within tenant boundary with security group scoping; indirect prompt injection demonstrated against similar enterprise agent architectures [4][7]. |
| External Data | 2 / 4 | Ingests third-party integration data via Agent Gateway and MCP protocol connections from partner agent ecosystem [10]. |
| Memory | 2 / 4 | Maintains conversational context and workflow state within session scope governed by tenant isolation controls [7]. |
| Reasoning | 2 / 4 | LLM-based reasoning processes business logic without published boundary testing or adversarial evaluation results despite demonstrated susceptibility across frontier models [5]. |
| Planning | 2 / 4 | Multi-step workflow planning executes through Skills framework with security group enforcement on tool access [7]. |
| Tool Execution | 1 / 4 | Tools operate within the ASOR-governed Skills boundary with explicit security group permissions required for each capability [7]. |
| Orchestration | 2 / 4 | Agent Gateway routes requests across internal and external agents using MCP and A2A protocols with host-mediated security [10]. |
| Inter-Agent | 2 / 4 | Partner agents connect through Agent Gateway with registration lifecycle validation but no published content inspection [11]. |
| Output Processing | 1 / 4 | Outputs flow through Workday platform channels with content guardrails documented but no independent DLP verification [7]. |
| Configuration | 1 / 4 | Security administrators manage agent permissions through existing Workday role-based access control infrastructure [6]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Workday Illuminate ingests third-party integration payloads via Agent Gateway while holding OAuth-scoped access to employee PII and financial records and sending notifications and integration writes across the operator trust boundary.
Workday Illuminate exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Agent Gateway accepts MCP and A2A payloads from registered partner agents with security group enforcement but content remains authored by external parties [10].
- Sensitive data — The agent operates on employee PII and payroll data and OAuth credentials for connected enterprise integrations [1].
- External egress — Default outbound channels include email notifications and integration API calls and inter-agent messages via Gateway [12].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. Credential access dominates the blast profile with a documented supply-chain incident while code execution and deployment remain unexposed.
Scores reflect maximum documented damage potential per factor based on default agent capabilities and incident history.
Six canonical blast factors scored against agent-specific evidence where available and vendor-documented capabilities otherwise.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 0 / 4 | No documented code execution capability exists in the default Skill set beyond structured workflow actions [7]. |
| File system access | 1 / 4 | Limited document attachment handling within Workday platform storage without direct file system write access to infrastructure [7]. |
| Network access | 2 / 4 | Agent Gateway integration calls represent agent-initiated outbound API connections to external services crossing the trust boundary [10]. |
| Credential access | 3 / 4 | OAuth tokens for connected integrations were demonstrated compromisable in the supply-chain incident involving UNC6395 [2]. |
| Autonomous action | 2 / 4 | Workflow approvals and payroll transactions and employee record updates execute without per-action human confirmation [7]. |
| Deployment access | 0 / 4 | No documented capability to modify agent deployment configuration or infrastructure from within agent execution context [11]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. Vendor-documented controls provide partial coverage through security group enforcement and identity governance while output guardrails represent the primary gap.
Scores use the inverted scale where higher values indicate stronger documented controls at inferred confidence.
Five canonical defense components scored against vendor documentation with confidence flags reflecting the absence of independent verification.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | Content guardrails mentioned in ASOR documentation but no published filtering rules or independent prompt injection defense validation available [7]. |
| Execution Isolation | 2 / 3 | Agent System User identity model with security group enforcement provides logical isolation within the responsible AI governance framework [9] without published sandbox boundary [7]. |
| Action Controls | 2 / 3 | Security groups restrict tool access per agent registration but default Skills execute business-critical actions without per-action approval [7]. |
| Output Guardrails | 0 / 3 | No documented output filtering or DLP integration or response sanitization for agent-generated content in the default configuration [6]. |
| Monitoring | 2 / 3 | ASOR governance provides agent identity tracking and audit logging with ISO 42001 certified AI management [13] and active vulnerability disclosure via responsible reporting channels [14] but anomaly detection for adversarial behavior is not documented [8]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize output guardrail deployment and input filtering verification to close the primary documented gaps.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Define an allowlist of permitted integration sources in Agent Gateway configuration to reduce untrusted input surface from partner agents.
- Configuration Enable content inspection for MCP and A2A protocol messages at the Agent Gateway routing layer before delivery to agent Skills.
- Engineering Deploy a prompt injection detection layer at the agent input boundary using pattern matching on known injection payload signatures.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Restrict each agent security group to the minimum required Skill set and revoke inherited permissions from parent roles.
- Configuration Configure Agent System User permissions to enforce least-privilege execution scope per workflow type and tenant partition.
- Engineering Implement capability-based sandboxing for Skill execution that restricts system call access beyond security group enforcement to contain compromised agent processes.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Enable per-action human approval gates for high-impact operations including payroll changes and financial approvals and credential rotation.
- Configuration Configure action rate limits per agent identity to detect and throttle automated exploitation of autonomous workflow capabilities.
- Engineering Extend the existing ASOR Agent System User identity model to require distinct agent identities for transaction initiation versus approval execution workflows.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Configure DLP inspection at the Workday Integration Cloud layer to detect and redact sensitive data in agent output channels before delivery to external integrations.
- Configuration Configure URL and link sanitization for agent-generated notifications and messages before reaching downstream consumers.
- Engineering Implement response content classification to flag agent outputs containing PII or credentials before external transmission.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Forward ASOR agent audit logs to organizational SIEM for correlation with identity and access management events.
- Configuration Configure alerting for query volume exceeding historical baseline by a defined threshold and Skill invocations outside business hours to detect compromised agent sessions.
- Engineering Implement agent behavior baselining to detect prompt injection indicators such as sudden scope expansion or unauthorized tool invocation.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- Workday HCM API Misconfiguration Varonis discovered improperly scoped OAuth API endpoints enabling cross-tenant token enumeration and HR data exposure at Fortune 500 firms.
- Workday Salesloft Drift Incident Response Vendor-published incident response documenting third-party OAuth token compromise by UNC6395 and credential invalidation remediation.
- Workday Data Breach 2025 Analysis Independent analysis of ShinyHunters social engineering and Salesloft Drift supply-chain OAuth compromise affecting Workday environments.
Selected Research
- Web-Based Indirect Prompt Injection in the Wild Palo Alto Unit 42 documents in-the-wild indirect prompt injection against enterprise AI agents processing web content.
- AI Agent Security from Large-Scale Red-Teaming NIST CAISI research on agent hijacking showing successful attacks against all tested frontier models in agentic scenarios.
Vendor Documentation
- Workday Security and Privacy Trust Page Documents AES-256 encryption at rest and TLS in transit plus Key Management Service lifecycle controls and security administrator roles.
- Workday ASOR Datasheet Describes Agent System User identity model with content guardrails and security groups for tool access and Agent Gateway routing.
- Workday Compliance and Certifications Lists SOC 2 Type II and ISO 27001 and ISO 42001 and FedRAMP Moderate authorizations with scope covering enterprise products.
- Workday Responsible AI Documents ISO 42001 certification and NIST AI RMF attestation with data privacy commitments verified by Schellman and Coalfire.
- Agent Gateway and Partner Network Announces Agent Gateway enabling external agent connection via MCP and A2A protocols with security group enforcement.
- Workday Agent Definition API Public API specification documenting agent registration lifecycle and skill configuration with security group enforcement.
Other Sources
- AI Agent Protocols for Multi-Agent Systems Workday DevCon 2025 blog on MCP and A2A protocol adoption with cybersecurity governance requirements for agent communication.
- Workday ISO 42001 Certification Announcement Press release confirming ISO 42001 AI management system certification and NIST AI RMF attestation by Schellman and Coalfire.
- Workday HackerOne Disclosure Program Active responsible disclosure program confirming Workday maintains a vulnerability reporting channel through HackerOne.