Headcount by organisation against last month, workers whose manager changed, vacancies against approved headcount, and every business process step waiting more than a week, grouped by approver.
The data is all there, immaculately governed, and getting a specific answer out needs either a saved report somebody built in 2021 or a request to a functional analyst with a two-week queue. So people export what they can and rebuild it in a spreadsheet, monthly, forever.
A companion reads what your account can read and assembles the rest, with the inputs shown. The account you connect sits inside your tenant’s security model, where domain security and business process security policies apply to integration access exactly as they do to a person.
01
How much can a connected account see?
Exactly what its security groups allow, and not a field more.
Domain security and business process security policies apply to integration access as they do to a person, and an account provisioned for one purpose sees one purpose worth of data.
Treat that as a feature. Whether this can read compensation for the whole company is decided by your security administrator in the tenant, in advance, rather than by a prompt.
02
What is worth assembling from worker data?
The recurring questions that currently need an export.
Headcount by organisation with a comparison to last month, workers whose manager changed in the period, position vacancies against approved headcount, tenure distribution for a department. Reading and arithmetic, with the inputs shown.
A companion also reconciles Workday against other systems, which is where most of the mess lives. The directory, the ticketing tool and the access management system all have a view of who works here, and they disagree.
03
Business process steps that have been waiting
A companion reports what is stuck and who is sitting on it: steps awaiting approval for more than a week, grouped by approver, with what they are approving named so the nudge makes sense.
Advancing a step stays with the approver. In a tenant where approvals are the audit trail, that boundary is not negotiable.
04
This sits in front of the analyst queue
Most requests reaching an analyst queue are two reports and a join, and a companion produces that from the data your account already reaches, with the caveats stated. Requests that genuinely need tenant configuration still go to the analyst.
Within the security groups of the account you connect, yes. Domain and business process security apply to the connection exactly as they apply to a person.
Yes, inside your tenant’s security model. You connect an account, a companion reads exactly what that account’s security groups allow, and it reports which business process steps have been waiting and who holds them. The reachable surface is the public API exposed for that app.
It assembles the answer from what your account reaches and shows the inputs. For anything quoted externally, pull the governed report from the tenant, because that is what an auditor recognises.
Approvals are the audit trail and stay with people. A companion reports which steps have been waiting and who holds them, grouped by approver, and drafts the nudge.
Point a companion at Workday plus the other list and ask for the differences. The interesting output is usually manager changes that happened in one system and never in the other.
For questions that span the HCM and three other systems, an agentic browser working your logged-in sessions answers in one pass. Download Strawberry and start with one reconciliation.
Workday Strawberry