ISU (Integration System User) — Workday

Workday's dedicated service-account pattern for API integrations. An Integration System User (ISU) is a Workday user account specifically created for machine-to-machine API access — distinct from human Workday users and exempt from password expiration policies that would otherwise break integrations.

An ISU is paired with an Integration System Security Group (ISSG) that defines exactly which Workday data domains (Worker, Organization, Job Profile, Position, Compensation, etc.) the ISU can read or write. The principle of least privilege applies: each integration gets its own ISU with the minimum ISSG it needs.

AE Guardian's workday-rest connector requires an ISU with read access to the Worker, Organization, Job Profile, Supervisory Organization, and (optionally) Position data domains. The Workday admin creates the ISU + ISSG; AE configures the ISU credentials in the connector's System Parameters.

Equivalent patterns elsewhere: SAP service-account user (for sap-hr), PeopleSoft operator (for people-soft), API Client in ClearPass / Cisco ISE.