Why Workday Security Audits Are the Hardest Job to Do by Hand (and How an Agent Traces Them)

Answering a single Workday security question—such as "Who can see base compensation in EMEA?" or "Why can't Priya see the bonus field on her direct report's profile?"—is one of the slowest manual jobs in enterprise administration. Because Workday evaluates effective access at the intersection of Securable Items, Domain Security Policies, Role-Based Constrained Security Groups, and Organizational Hierarchies, no single screen gives you the whole answer. An AI agent connected to your live tenant solves this by reading each link in the chain and reporting the exact policy, group, or missing role assignment that grants or blocks access.

Why a ten-word question turns into a forty-minute trace

Every Workday administrator and functional consultant knows the gap between how an executive asks a security question and how Workday stores the answer.

An internal auditor asks: "Can you confirm which HR partners can edit compensation outside their own region?" Or a service desk ticket lands at 4:30 PM: "Marcus moved into the new clinical division on Monday, and now his manager Priya can't see his compensation tab or initiate a job change."

In a flat permission system, you would open a user record, inspect a list of assigned roles, and read an access matrix. Workday's security architecture is deliberately much richer than that—and much harder to read by hand. Workday separates what is being protected (the securable item and its domain or business process policy) from who holds a role (the security group) and where that role applies (the constrained organizational context).

To answer either question by hand, you have to keep five separate browser tabs open and cross-reference their outputs yourself.

The five-screen manual trace

When a user cannot see a report column, a profile field, or an initiation task, a careful consultant walks the same five-step diagnostic chain every time:

If you are diagnosing a single missing field for Priya, walking those five screens takes fifteen to twenty minutes—assuming you pick the right securable item on the first try. If the field is a multi-tier calculated field, you have to repeat Steps 1 through 3 for every Lookup Related Value and Extract Single Instance in the dependency tree.

And if you are answering the auditor's question—"Who can see base compensation?"—you have to trace the chain in the opposite direction: from every domain under Worker Data: Compensation out to every unconstrained and constrained security group, and from each group out to every active worker holding that role assignment across the tenant.

The four traps that hide the real cause

Even experienced administrators lose hours to four subtle behaviors in Workday's security model:

1. Constrained vs. unconstrained confusion

As covered in our guide on constrained vs. unconstrained security groups, granting a security group View access on a domain policy is only half the configuration. If a consultant accidentally selects Role-Based (Unconstrained) instead of Role-Based (Constrained) when building a regional HR group, every member of that group can suddenly view records across the entire enterprise. Conversely, if a group is constrained to the current organization only (Applies to Current Organization rather than Current Organization and Unassigned Subordinates), creating a new child supervisory organization immediately blinds the regional partner to everyone hired into the new team.

2. Intersection and aggregation security groups

Enterprise tenants rarely rely on a single role-based group for sensitive pay or executive data. Instead, they use Intersection Security Groups—requiring a user to be, for example, both an HR Partner for the worker's Supervisory Organization and a member of a location-specific group or a job-level segment. When access fails on an intersection group, View Security for Securable Item shows that the intersection group is permitted on the domain, and View Security Groups for User may show the user in both underlying groups—yet access still fails because the organizational contexts of the two underlying groups do not overlap on the target worker.

3. Underlying fields inside a calculated field

When a user runs a custom report and a column comes back blank, the report itself is rarely broken. Workday evaluates security on every field referenced inside a calculated field. If an Evaluate Expression checks a worker's talent rating, compensation grade, and supervisory organization, and the person running the report lacks View permission on even one of those intermediate domains, Workday suppresses the output for that row without displaying a permission error.

4. Unactivated policy edits

A consultant adds a security group to a domain security policy in Sandbox, checks the domain screen, sees the group listed, and wonders why proxy testing still fails. Until Activate Pending Security Policy Changes has been run, the edit sits in a pending state and Workday's runtime security evaluator ignores it.

Why generic AI chatbots cannot help with a security audit

When you ask a web-based chatbot why a manager cannot see a field or how to clean up a domain policy, the chatbot is guessing in the dark. It cannot see your tenant's View Security for Securable Item output, it does not know which custom security groups your implementation partner created six years ago, and it cannot compare Priya's role assignments against Marcus's supervisory organization hierarchy. At best, it hands you the same five-step click list you already know by heart.

Coding agents that require you to register an Integration System User (ISU) and an API client before you start are no better suited for a quick functional audit: setting up an API client with the right domain scopes takes longer than doing the audit by hand.

How kiweely traces the entire security chain in your tenant

kiweely is a desktop app for Workday developers, consultants, and admins that works directly in your real tenant using your own Workday sign-in. You do not configure an API client or copy-paste tables into a browser chat window.

When you open a conversation in kiweely, tick your client's Sandbox or Implementation tenant, and ask "Why can't Priya see Marcus's compensation section?" or "Who can see compensation in this tenant?", kiweely does the legwork across the live setup:

1. Reads the securable item and its policy. kiweely looks up the exact field, report column, or task, identifies the governing domain or business process security policy, and checks whether any pending security changes are waiting for activation.
2. Evaluates every security group on the policy. It inspects the permitted security groups, distinguishing unconstrained groups from constrained role-based, intersection, and segment-based groups.
3. Cross-references the people and their organizations. For a user-access ticket, kiweely reads the acting user's security groups and role assignments alongside the target worker's supervisory hierarchy, company, cost center, and location. It pinpoints the exact mismatch—for example, that Marcus's new supervisory organization broke inheritance for the Compensation Partner role, or that an underlying field in a calculated column sits in a domain the manager's role cannot view.
4. Asks before making any change. If the fix requires updating a domain policy, assigning a role on an organization, or activating pending security policy changes, kiweely stops and shows you an approval card naming the client, the tenant, and the exact parameters. Nothing changes in Workday until you approve it.
5. Verifies the fix as the real persona. Once you approve a change in a non-production tenant, kiweely can test the result with Start Proxy in a browser you can watch—signing in as Priya to confirm she can see what she needs and cannot see what should stay restricted. Our multi-persona proxy testing guide covers why testing both sides of that boundary matters.

Because kiweely keeps each client's conversations, projects, and documents together—and pins every conversation to a single client's sign-ins—you can also ask it to turn the trace into a clean security audit workbook or design note filed directly in the project.

Try it on your own security questions

The next time a ticket asks why a task disappeared, why a report column is blank for one role, or why a business process is stuck Awaiting Action after a reorganization, hand the question to kiweely in a conversation connected to your tenant and watch it trace the chain from securable item to supervisory org.

Kiweely Personal is free for your Workday personal developer account and its tenant. Any other tenant needs a Personal licence, $99 a month, or a seat in your firm. Every new account also starts with $5 of Kiweely Credits, which run on Amazon Bedrock in the United States and keep nothing you send.