In Workday HCM, when security access must follow a position rather than a specific individual, the correct solution is to use a role-based constrained security group . This is especially important when the position is vacant, as assigning security to a person would not meet the requirement and would require reconfiguration once the role is filled.

The first step is to run the Maintain Assignable Roles task. This task enables administrators to define which role-based security groups can be assigned to organizations. Without completing this step, the role cannot be attached to an organization or used in an organizational context.

Next, a role-based constrained security group is created. Constrained security groups restrict access based on organizational assignments, allowing the role to support a specific organization and its subordinate organizations. This aligns precisely with the requirement for the HR Generalist position to support a new organization hierarchy while maintaining proper security boundaries.

Finally, the position is assigned to the new role on the organization. Assigning the role to the position—not the worker—ensures that security access automatically transfers to whoever occupies the HR Generalist position in the future. This supports scalability, reduces administrative effort, and follows Workday’s security best practices.

The other options are incorrect because user-based security groups require an incumbent and do not support vacant positions, while unconstrained security groups grant overly broad tenant-wide access. Activating pending security policy changes alone does not satisfy the requirement to scope access by organization.

Therefore, Option A is the only configuration that is accurate, scalable, and fully aligned with Workday Pro HCM security design principles.