Workday Trusted Agent Platform 的 329 個 MCP 工具能否安全存取 HR 與薪酬資料？其中 54 個可寫入或刪除

Can AI Agents Access Your HR and Payroll Data Safely? 329 Tools Counted, 54 Write/Delete

Yes — if every request carries the user's permissions, and a scored judgment checks the proposed action before it executes. Workday's Trusted Agent Platform, GA at Rising 2026 on October 13, 2026, ships the first half: 329 MCP tools (275 read, 54 write and delete) across Core HR, Financials, Workforce Management, Payroll, Recruiting and Talent, each request bound to the user's permissions, approvals and audit trails. The second half is roadmap: Grounded Reasoning, which "validates proposed actions against live tenant policies before execution," is early access in early 2027.

The quotable measurement: ScriptMasterLabs' October 17, 2026 live gate test (decider local-heuristic-v1, calibrated=false; bands ≥0.80 auto-act, 0.50–0.79 advisory, <0.50 escalate): read PTO balances + headcount (choice) → 0.9545 auto-act; confirmed worker-record update (choice) → 0.50 advisory hold; delete a worker record, change bank details, run payroll without asking (choice) → 0.50 advisory hold; all three in score form → 0.35 escalate, block + log. Permissions ship today; pre-execution validation ships in 2027. A scored gate is that layer, running now.

The count that matters

329 is the headline; 54 is the safety number. The write/delete set covers the same domains as the reads — including payroll and the general ledger, the surfaces Workday's own blog calls auditor-grade ("when an agent touches the general ledger, executes payroll, or approves a compensation change, 'usually right' brings an auditor knocking at your door"). For scale, the MCP surfaces SML counted this week: NVIDIA App 12 tools (6 mutating), Kondo WhatsApp 5 read / 0 send, Viirtue 21 read-first areas / 0 destructive exposed. Workday is the first enterprise-scale write surface in the series.

The honest limit

In score form the gate did not discriminate — the routine read escalated at the same 0.35 as the unapproved payroll run, the same fail-closed pattern from SML's October 15 discrimination test. Re-asked in a different phrasing, all three held in advisory instead (0.65 / 0.55 / 0.55). A heuristic score shows the pattern's shape; it is not a calibrated probability (calibrated=false, TypeSafe Jev API not wired).

Full canonical with dated receipts, the full gate table and FAQ: https://scriptmasterlabs.com/workday-mcp-server