AI agents for HR: Connecting Workday and ServiceNow with scoped permissions

TL;DR: AI agents for HR can now automate employee self-service (leave balances, time-off requests), manager actions (job changes with HRBP approval in Slack/Teams), ticket deflection (knowledge base first, ServiceNow case only when needed), joiner/leaver workflows (spanning HR, IT, finance), and daily task digests. The architectural choice matters: a unified endpoint layer (covering Workday's nearly 600 tools alongside ServiceNow, Greenhouse, and 1,500+ other apps) beats stitching together separate single-vendor MCPs for each system. Enforcement happens through the employee's own Workday permissions, with read-only deployment first, write actions gated by team, SSO/SCIM for identity lifecycle, and every tool call logged for SIEM export. Composio provides this unified layer with SOC 2 Type II and ISO/IEC 27001:2022 certifications already in place.

Your HR team just rolled out Workday and ServiceNow across the enterprise. The promise was employee self-service and automated workflows, but the reality is your HRBPs still spend hours each week manually processing leave requests, chasing manager approvals, and updating employee records across disconnected systems. Meanwhile, your AI platform team is evaluating whether agents can take on these repetitive HR jobs without creating a new category of access risk you'll have to defend in the next audit.

The question is not whether AI agents can read Workday's leave balance API or create a ServiceNow ticket. They can. The harder question is whether they can do it while enforcing least privilege, maintaining a complete audit trail, and routing approvals through the humans who need to stay in the loop. This article covers the five HR job categories where agents are delivering measurable value today, the architectural decision between vendor-specific MCP servers and a unified endpoint layer, and the control framework that satisfies security review without slowing down the business.

Employee self-service in Slack or Teams

The first job agents take on is employee self-service, and it goes further than the FAQ chatbot you deployed two years ago. When an employee asks "How much PTO do I have left?" in Slack, the agent does not just retrieve a number from Workday. It checks the balance against company policy, submits the time-off request if the employee wants to proceed, routes it to the manager for approval, and can update the calendar once approved. The employee never opens the Workday portal.

This works because the agent connects to Workday through a single OAuth connection and calls Workday's web services. Workday's Absence Management web service includes operations such as Get_Time_Off_Plan_Balances, which retrieves balances by worker and time off plan, and Enter_Time_Off, which uses the Request Time Off business process. The agent handles the full workflow: check balance, apply policy, submit request, route for approval, send confirmation.

The critical control is that every request runs with the employee's own Workday permissions. In a hypothetical example, when Sarah from Marketing asks about her leave balance, the agent presents her OAuth token to Workday, which enforces her role-based access. She sees her own balance, not her manager's, and she cannot query organizational salary data just because the agent technically has API access.

This follows a delegated-access pattern. OAuth 2.0 token exchange (RFC 8693) is one standards-based mechanism for representing that delegation, including an optional act (actor) claim. The exact implementation depends on the authorization system and integration configuration.

Composio's Workday toolkit exposes this as an app user connector where each end user connects their own Workday account, and every request runs with that user's permissions. You can test this pattern with Composio's Workday toolkit to see how the authentication flow works before committing to a full deployment.

Manager actions with HRBP approval in chat

The second job category is manager-initiated actions that require HRBP approval before execution. A manager wants to change a direct report's job title, open a new requisition, or move a candidate to the next interview stage in Greenhouse. For example, instead of logging into Workday or the ATS, the manager sends a message in Slack: "Change Alex's title to Senior Product Manager." The agent initiates the workflow but does not execute it yet.

The agent routes an approval request to the HRBP in chat with the full context: current title, proposed title, effective date, compensation impact. The HRBP reviews and approves with a button click. Only then does the agent execute the job change in Workday and post the confirmation back to the channel. The same pattern applies to candidate movements in Greenhouse or Ashby, where the agent can trigger stage transitions but requires recruiter approval before the ATS updates.

Composio's Workday MCP supports business process-level actions like "Create Business Title Change," which creates a business title change instance through Workday's v1 REST API. The action maps to Workday's native business processes, which means the agent triggers the same workflows a human HRBP would initiate through the Workday UI, complete with all downstream validations and notifications.

The human-in-the-loop control requires an approval step before sensitive actions execute. The agent pauses the tool call until the designated approver reviews and authorizes it. One standards-based option is OpenID Connect Client-Initiated Backchannel Authentication (CIBA), where the approver confirms on a separate device such as their phone. Composio offers selected-tool approvals, but the feature is experimental and has client and sandbox limitations that teams must evaluate before production deployment.

Ticket deflection that answers from the knowledge base first

The third job is ticket deflection, and the logic is straightforward: answer from the knowledge base first, and only open a ServiceNow case when a person is genuinely needed. When an employee asks "How do I update my direct deposit information?" the agent searches the ServiceNow knowledge base using retrieval-augmented generation (RAG). If it finds a confident match, it returns the answer with a citation to the source article. If confidence is low or no article exists, it creates a ServiceNow incident with the conversation context already filled in.

This two-tier logic has delivered measurable results. In a representative case study, Pronix reports a 58% deflection rate for a global manufacturer's IT service desk by grounding answers on the ServiceNow KB and SharePoint runbooks, with a "no confident answer → route to human" rule. The agent does not guess. If the knowledge base does not contain the answer, the agent creates a ServiceNow incident with the conversation context pre-filled, so the HR rep receives a complete record without asking the employee to repeat themselves.

The deflection rate depends heavily on knowledge base quality. ServiceNow's Virtual Agent uses AI Search to retrieve relevant knowledge base articles. If the query remains unresolved, configured fallback options can create an incident. If your KB is outdated or incomplete, the agent will escalate more tickets than it deflects. Before deploying this workflow, audit your top 50 HR ticket categories and confirm each has a current KB article. The agent will surface gaps in your documentation faster than any manual review.

Joiners and leavers across HR, IT, and finance

The fourth job category is the most complex: orchestrating joiner and leaver workflows across HR, IT, and finance systems. When a new hire is marked as active in Workday, that event needs to trigger account provisioning in Active Directory, equipment requests in ServiceNow, and payroll setup in the finance system. When an employee is marked as terminated, the reverse workflow executes: deprovision access, recover equipment, process final payroll.

ServiceNow offers a Workday HR Spoke for connecting Workday HCM data to ServiceNow workflows. In a typical setup, a hire in Workday prompts ServiceNow to provision equipment, set up accounts, create onboarding tasks, notify facilities, and launch training workflows. The agent coordinates this orchestration, monitoring each system's completion status and escalating if any step fails.

For offboarding, the agent uses the termination date in Workday as the trigger for tasks in ServiceNow, Active Directory, and the finance system. The workflow executes until the exit is complete, with actions requiring HR or IT judgment paused for approval, in line with OWASP's guidance to require human approval for high-impact actions. If the employee is in a sensitive role, the agent might require CISO approval before deprovisioning access to financial systems.

This is where the architectural decision between vendor-specific MCPs and a unified endpoint layer becomes critical. If you are running a separate Workday MCP, ServiceNow MCP, Active Directory MCP, and finance system MCP, your agent needs to load four different endpoints, maintain four different authentication contexts, and correlate logs across four different audit trails. A unified endpoint layer handles all four systems through a single connection point, with one authentication context and one audit trail. The next section covers this architectural decision in detail.

A daily "what needs my attention" list

The fifth job is proactive: a daily digest of what needs each HR user's attention, delivered in Slack or Teams before they start their workday. The agent aggregates pending approvals from Workday (leave requests, job changes, compensation updates), open tickets from ServiceNow HRSD assigned to that user or their team, and upcoming performance review deadlines from the calendar. It also surfaces any exceptions flagged overnight, such as failed provisioning or incomplete offboarding tasks.

The digest is personalized based on the user's role. An HRBP sees pending job changes and compensation reviews. A recruiter sees candidates stuck in interview stages for more than five days. An HR operations manager sees incomplete offboarding checklists and upcoming new hire start dates. The agent compiles this each morning by querying Workday's pending approvals API, ServiceNow's incident table filtered by assignment group, and the calendar for deadline items, then pushes a structured message to the user's chat channel.

Open enrollment season is a common stress test for this workflow. HR teams receive frequent questions about copays, PTO balances, and benefits elections, and an AI agent can help handle these surges by answering from plan documents and employee data specific to each employee's location. The daily digest includes a summary of how many benefits questions the agent deflected the previous day, how many required human escalation, and which KB articles were accessed most frequently, giving the HR team visibility into what's working and what needs attention.

One layer, not one MCP per app

The architectural decision you make early determines whether this deployment scales or collapses under its own complexity. The choice is between vendor-specific Model Context Protocol (MCP) servers (one for Workday, one for ServiceNow, one for Greenhouse, one for your finance system) versus a single unified endpoint layer that proxies all of them.

Single-vendor MCPs typically expose tools for their respective vendors, potentially requiring separate setup, authentication, and monitoring across systems. Under the MCP specification, each protected MCP server acts as its own OAuth resource server and must only accept tokens issued specifically for it. When an agent coordinates a joiner workflow across Workday, ServiceNow, and Active Directory using separate vendor MCP servers, teams may need to manage multiple connections, authentication configurations, and audit streams. A unified endpoint layer can centralize these integration concerns.

A unified endpoint layer exposes a single URL to your agent for all tool access. The agent sends all tool requests to this gateway endpoint, and the gateway routes each request to the right backend integration, so the agent does not need to know the backend topology. Authentication is centralized (one OAuth connection per user per app, managed in one place), and the audit trail is unified (one log stream showing every tool call across all systems).

Comparison: Vendor-specific MCPs vs. unified endpoint layer

Composio provides this unified endpoint. The platform offers a secure MCP endpoint that handles authentication and logging for every tool call. For Workday specifically, this means access to nearly 600 tools, including business process APIs like "Create Time Off Request" (which initiates the full approval workflow), "Create Compensation Scorecard" (which touches Workday's Compensation v3 API), and "Get Business Process" (which retrieves a business process event by its ID).

The business process depth matters because HR workflows do not map cleanly to simple CRUD operations. When a manager requests a title change, Workday does not just update a field in the employee record. It initiates a business process that routes through approval chains, validates against compensation bands, updates reporting structures, and triggers downstream notifications. Composio's Workday MCP exposes these business process APIs directly, so the agent triggers the same workflow a human HRBP would initiate through the Workday UI.

The alternative is building and maintaining separate integrations for Workday, ServiceNow, Greenhouse, your finance system, and every other tool in the HR stack. Each integration is an OAuth flow to build, a token refresh cycle to manage, a rate limit to handle, and an API versioning issue to track. The unified endpoint layer consolidates that maintenance burden into a single vendor relationship.

Controls: Scoped permissions, approvals, and audit

The job categories above only work in production if the control framework satisfies your security review. The controls fall into four categories: delegated permissions, approval gates, identity lifecycle management, and audit logging.

Acts as the user with their own Workday permissions

The agent does not operate with a service account that has broad access to Workday. It acts as the user, with that user's own role-based permissions enforced by Workday's access control. This is implemented via OAuth 2.0 token exchange, where the agent presents the authenticated user's access token (the subject token) and its own credentials (the actor token) to the authorization server, which issues a new access token for the request. That token contains an act (actor) claim that tells downstream resources the agent is acting on behalf of a human user, and the agent never sees the user's credentials.

In the same hypothetical scenario, when Sarah from Marketing asks the agent to check her leave balance, the agent uses Sarah's OAuth token. Workday enforces Sarah's permissions. She can read her own balance but not her manager's salary. If Sarah tries to get the agent to query data outside her permission scope, Workday denies the request, and that denial is logged. OWASP's guidance on excessive agency makes the same point: actions taken on behalf of a user should execute in that user's context on downstream systems, with authorization enforced there rather than by the LLM.

Read-only first, then writes per team

You do not deploy write access on day one. OWASP recommends limiting agents to the minimum permissions they need, which in practice means starting with read-only API scopes (GET operations only) so the agent can retrieve leave balances, org structure, and employee profiles without any risk of unintended changes. In this suggested rollout, the read-only phase runs for four weeks while you monitor accuracy, deflection rates, and edge cases.

Phase two enables specific write scopes for the HR Service Delivery team only: create and update service requests, publish KB articles, post approvals. In this proposed rollout, every write operation requires human approval before execution. The agent pauses the action until the designated approver authorizes it. Composio's selected-tool approvals can support this pattern in compatible configurations, but the experimental feature's limitations must be evaluated before production use. You measure the approval rate and identify bottlenecks where the approval requirement is slowing down work that should be automated.

Phase three expands write access to manager-level delegation for routine approvals (leave requests within policy limits) and to the HR team for compensation changes and title updates (still with human approval). An agent working for a user stays inside that user's rights through delegation, while an autonomous agent should get its own role, a named owner, and periodic access reviews, in line with NIST's least privilege control (AC-6). You disable human-in-the-loop only for routine, low-risk actions like leave balance retrieval, which stays automatic.

Phase four is full production rollout, extending write permissions to IT for provisioning workflows and to finance for limited payroll data updates. Access reviews happen quarterly, and automated policy enforcement blocks requests outside business hours or requests by agents acting outside their primary user's scope. Register each agent's credentials before it goes live, giving each agent a credential of its own and a traceable record in every system it touches.

SSO and SCIM for identity lifecycle

SSO handles authentication (verifying the user is who they claim to be at login), while SCIM handles user provisioning. The SCIM protocol (RFC 7644) covers provisioning and managing identity data across domains, and leaves authentication to other standards. For HR agents, both are required.

SSO via SAML or OpenID Connect means the user signs in once through the corporate identity provider, and the agent's access to Workday is tied to that same identity. When Sarah logs into Slack with her corporate SSO credentials and asks the agent to check her leave balance, the agent acts on her behalf under that verified identity.

SCIM keeps accounts provisioned, updated, and deprovisioned as employee records change in the directory. When an employee is marked as terminated in Workday, SCIM triggers deprovisioning across all connected systems, including the agent's access. The agent can no longer act on that user's behalf because the user's account no longer exists in the identity provider. Prompt deprovisioning also supports GDPR, which requires appropriate technical and organisational measures to protect personal data under Article 32.

Composio supports SSO via SAML and OIDC (Okta, Entra ID, Google Workspace) and SCIM maps directory groups to teams, so Composio access mirrors your organizational structure. When an HRBP moves from the West region team to the East region team in your identity provider, SCIM updates their Composio team assignment, and their access policies update accordingly without manual intervention.

Every tool call logged and exportable to the SIEM

Composio records agent tool calls with user and team context, invoked actions, outcomes, and denied requests, providing a centralized audit trail across connected integrations.

Composio centralizes audit records across connected tools, capturing the user, team, tool, action, and outcome, including denied calls. These records can be exported and incorporated into an existing SIEM pipeline, such as Splunk, Microsoft Sentinel, or Datadog, using an organization-managed export and ingestion workflow. This allows security teams to correlate agent activity with other security events and retain evidence for compliance reviews without managing separate audit trails for each integration.

The audit trail includes denied calls, which is what makes it usable as compliance evidence rather than just an activity summary. When Sarah's agent tries to query organizational salary data and Workday denies the request because her role does not have that permission, that denial is logged. During your next SOC 2 audit, you can produce a report showing every access attempt, every approval, every denial, and every policy enforcement decision the agent made over the audit period.

SOC 2 Type II and ISO/IEC 27001:2022

Composio holds SOC 2 Type II and ISO/IEC 27001:2022 certifications, with pre-filled compliance packs covering common frameworks and insurance certificates available at trust.composio.dev. SOC 2 is an AICPA attestation that reports on controls relevant to five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. ISO/IEC 27001 is an international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

Both frameworks expect logging and monitoring controls, including protecting logs from tampering. When your enterprise prospect's security team sends a credential handling questionnaire, you can reference Composio's certifications and trust center documentation rather than assembling evidence from multiple systems. Composio provides pre-filled compliance documentation that helps IT teams respond to enterprise questionnaires with structured, ready-to-share evidence.

For HR contexts specifically, GDPR applies to employee personal data within its scope, while SOC 2 and ISO/IEC 27001 provide frameworks for assessing security controls. HIPAA's definition of protected health information excludes employment records held by a covered entity in its role as employer, though HIPAA can still apply to health plan information handled by a covered entity or its business associate. Controls evidenced for SOC 2 and ISO/IEC 27001 often overlap with GDPR's security obligations, which means the control evidence you produce for one framework can support the others.

How Composio handles this

Composio is the managed credential vault, OAuth manager, and policy enforcement layer between your AI agent and every external app it needs to reach. Your agent calls a tool, Composio resolves which connected account to use, decrypts the credential inside an isolated runtime, injects it into the outbound HTTP request, and returns the response. The credential is isolated from the LLM context and from your application code, stored with AES-256 encryption.

For HR deployments, this means you configure policies in Composio's dashboard: which tools are allowed, for which users, under which conditions. An admin disables the "delete" action for the Workday integration, and the agent cannot delete employee records regardless of what the prompt says or what a user tries to inject. Policy-as-code enforcement evaluates access restrictions in the request path before the model is involved, so an agent cannot escalate its own permissions.

The Workday toolkit exposes nearly 600 tools covering business process workflows. The ServiceNow toolkit handles incident creation, knowledge base search, and approval routing. Greenhouse and Ashby integrations manage candidate movements. All of these are available through a single endpoint, with centralized OAuth token management and a unified audit trail.

Composio is SOC 2 Type II and ISO/IEC 27001:2022 certified, with SSO via SAML and OIDC, SCIM 2.0 for directory sync, and audit logs that can be incorporated into an organization's SIEM pipeline. The free tier includes 100K tool calls per month with no credit card required, so you can test your first HR workflow before booking an enterprise demo. Production deployments typically start at the Pro tier ($29/month with usage-based scaling) and move to Enterprise for committed volume, KMS, SLA, and dedicated support. This reduces setup time from hours per app to minutes for the entire catalog.

Book a demo with Composio to see how scoped permissions, credential management, and audit logging work across your integrations.

FAQs

How do HR AI agents handle approvals for sensitive actions like job changes?

HR AI agents can use a human approval gate that pauses sensitive actions until a designated approver, typically the HRBP, authorizes execution. CIBA is one standards-based implementation pattern, but it is not a confirmed native Composio integration. Composio's built-in selected-tool approvals are experimental and subject to client and sandbox limitations.

What compliance certifications apply to AI agents processing HR data?

SOC 2 Type II and ISO/IEC 27001:2022 are common baseline certifications for HR service delivery platforms managing employee data at scale. GDPR applies when HR data includes EU residents' personal information and requires appropriate security measures to protect it. HIPAA excludes employment records held by an employer, though it may apply to health plan information handled by a covered entity or business associate. Composio holds SOC 2 Type II and ISO/IEC 27001:2022 certifications with pre-filled compliance packs.

How do I export AI agent audit logs to my SIEM?

Composio provides centralized audit records for tool activity, including denied calls. Organizations can export these records and incorporate them into Splunk, Microsoft Sentinel, Datadog, or another SIEM through a separately configured export and ingestion pipeline.

Can an HR agent access data outside a user's permission scope?

No. The agent presents the user's OAuth token to Workday or ServiceNow, and those systems enforce the user's role-based access control. If a user asks the agent to query data outside their permission scope (for example, an individual contributor trying to access organizational salary data), Workday denies the request, and that denial is logged. Policy-as-code enforcement at the Composio layer adds a second control, blocking entire action categories (like delete operations) regardless of the user's permissions.

What is the typical rollout timeline for deploying an HR agent?

A suggested phased rollout reaches full production in week 13. Weeks 1-4 are read-only deployment (agent retrieves data but makes no changes). Weeks 5-8 enable write actions for the HR Service Delivery team with human approval required. Weeks 9-12 expand to manager-level delegation for routine approvals. Week 13+ is full production rollout with quarterly access reviews and automated policy enforcement.

Key terms

Delegated authority: An authorization model where AI agents act on behalf of users through explicit grants rather than credential impersonation, implemented via OAuth 2.0 token exchange (RFC 8693). The authorization server issues the agent a narrowly scoped token containing an act (actor) claim that identifies it as acting on behalf of a human user.

Policy-as-code enforcement: Access restrictions set by administrators and evaluated in the request path as code before the LLM is involved in any decision. An agent cannot escalate its own permissions or reason around policy limits through prompt injection.

Business process API: Workday's native workflow endpoints that trigger multi-step approval chains, validations, and downstream notifications, rather than simple CRUD operations on employee records. Examples include "Create Business Title Change" and "Request Compensation Change."

Human-in-the-loop (HITL): A control pattern where the agent prepares an action but requires explicit human approval before execution. CIBA is one standards-based implementation mechanism, while Composio provides experimental selected-tool approvals with documented client and sandbox limitations.

Unified endpoint layer: A single MCP gateway that proxies multiple backend integrations (Workday, ServiceNow, Greenhouse, etc.) through one URL, with centralized OAuth token management and a unified audit trail, rather than requiring separate MCP servers per app.

Credential isolation: Architectural pattern where authentication tokens are stored with AES-256 encryption and isolated from both application code and the LLM context window. The agent calls a tool, the credential is decrypted inside an isolated runtime, injected into the outbound request, and never appears in the agent's memory or the model's context.