Workday Launches Agent Passport to Test and Monitor AI Agents in the Enterprise

Why It Matters

By embedding continuous safety checks, Workday helps enterprises adopt AI agents without exposing themselves to regulatory or operational risk, accelerating secure automation across core business functions.

Key Takeaways

• Agent Passport validates AI agents for security and compliance before deployment
• Tests cover prompt injection, jailbreak, data leaks, and goal hijacking
• Attestations follow MITRE ATLAS standards, enabling cross‑vendor comparisons
• Cisco is the sole testing partner at launch, with more to follow
• General availability slated for Q4 2026 after early‑access rollout

Pulse Analysis

Enterprises are rapidly adopting autonomous AI agents to automate routine tasks, but the speed of innovation has outpaced traditional security controls. Unchecked agents can expose organizations to prompt‑injection attacks, data exfiltration, or unintended business decisions, creating regulatory and reputational risk. Recognizing this gap, Workday introduced a suite of governance tools at its recent DevCon, positioning itself as a bridge between AI agility and corporate compliance. By embedding safety checks directly into the agent lifecycle, the company aims to reassure CIOs that AI‑driven process automation can scale without compromising governance frameworks.

The centerpiece, Agent Passport, acts as a continuous auditor that validates an agent’s behavior against public standards such as MITRE ATLAS. Before an action is executed, the system can allow, block, or reroute the request based on policy, and any violation generates a signed, auditable record. Workday has partnered with Cisco for the initial testing phase, ensuring that third‑party security experts perform the assessments rather than the vendor itself. This third‑party attestation model gives security teams a common language to compare agents from different providers, reducing vendor lock‑in and simplifying compliance reporting.

Beyond compliance, Workday unveiled Developer Agent and Agent‑Ready Tools, which streamline the creation of custom agents using open standards like AgentSkills and MCP. These components reduce hallucination risk by supplying precise business logic and real‑time data, while pre‑built Pipedream connectors extend functionality beyond the Workday ecosystem. Early‑access customers can experiment now, with full rollout expected by the end of 2026. If adopted widely, this integrated stack could accelerate AI adoption across finance, HR, and supply‑chain functions, setting a new benchmark for secure, enterprise‑grade autonomous agents.