At Workday Rising, we announced that Agent Passport is in Early Access. Instead of asking whether an agent is safe, IT teams can now check a signed record of what it was tested for, by whom, and to what standard. Watch a quick demo.
In this article we discuss:
In February, I shared that the Workday Agent System of Record (ASOR) was generally available, giving our customers visibility and control over all of their AI agents. Today I'm excited to share that Agent Passport, the agent trust layer built on ASOR, is now in early access.
Agents have started doing real work in the most sensitive parts of the enterprise: onboarding employees, processing payments, and running critical processes across HR, finance, and IT. But that also raises a hard question for every CIO: how do you know an agent is safe to turn on?
An agent that works isn't the same as an agent you can trust. I've been at Workday for nearly two decades, and I've seen firsthand what it means for customers to trust us with their people and their money. As agents take on that work, they need to earn that same trust.
Agent Passport turns "is this agent safe?" into something you can check: a signed, auditable record of what's been verified about an agent, who verified it, and to what standard. Testing is independent and tied to public industry standards, so results are comparable across agents from any vendor, Workday-built or third-party. We're bringing together our first cohort of early adopters to run it against real production agents in HR and finance, with general availability planned for the end of the year.
But a record is only as meaningful as the accountability behind it. Alongside Agent Passport, we're introducing Agent Owners, which assigns a named, accountable person to every AI agent an organization runs. Now, every agent gets verified and has someone who answers for it.
A stamp answers three questions about an AI agent: What was it tested for, who tested it, and against which standard? Each stamp is a verifiable record that an independent party tested the agent for a specific risk, against a published industry standard.
The roles are simple. Workday defines what can be tested. Independent assessors do the testing or the assessment. Workday issues the stamp. And customers put the stamp to work, using it to decide how an agent can be deployed.
For CIOs deciding whether an agent gets access to HR or finance data, this removes the trade-off they've had to accept. They no longer have to choose between taking a vendor at its word and slowing deployment down for a manual review—they can lean on Agent Passport’s evidence instead.
A stamp gives them evidence they can check in minutes, instead of a security questionnaire they have to chase down. And the absence of a stamp tells them something too. For example, if an agent doesn't have a prompt-injection resistance stamp, it can still run if they permit it, but now they're trusting it blind.
For a CIO, those three questions only mean something if the verification behind it was actually performed by independent testers.
CIOs no longer have to choose between taking a vendor at its word and slowing deployment down for a manual review—they can lean on Agent Passport’s evidence instead.
Cisco AI Defense runs the adversarial testing—including prompt injection resistance and jailbreak resistance—behind the security stamps on every agent Workday builds and ships. Our own product teams go through that process first, working with Cisco to get each of those agents tested and stamped.
For agents built by third parties or by customers, the developer or customer works directly with an assessor to get the assessment done. If you're building agents, this is a good time to get yours assessed.
Our own product teams go through that process first, working with Cisco to get each of those agents tested and stamped.
Most enterprises already work with a range of security vendors. We plan to grow Agent Passport's network of independent assessors to include vendors our customers and partner developers already use.
That’s why Straiker, the agentic AI security company, plans to join as the first expansion of Agent Passport’s security tester network, bringing its Ascend AI red-teaming platform into a planned integration. Ascend AI will test whether agents can be prompt-injected, hijacked, or tricked into misusing tools, along with other attack paths mapped to frameworks such as the OWASP Top 10 for LLM Applications and the Top 10 for Agentic Applications.
The goal is to meet customers where their existing vendor relationships already are, and keep growing the network.
Straiker, the agentic AI security company, plans to join as the first expansion of Agent Passport's security tester network.
Adversarial testing answers whether an agent can be broken, and how. It doesn't answer whether oversight, data handling, and audit trails have been assessed against a governance standard like the EU AI Act, ISO/IEC 42001, or the NIST AI Risk Management Framework.
That's the axis OneTrust will open. A Workday Agent Passport Framework inside the OneTrust Platform maps each Governance, Risk, and Compliance (GRC) Stamp to the relevant sub-controls of those frameworks, so developers can reuse evidence they already maintain. OneTrust will submit those findings to Agent Passport.
As with every assessor in the network, Workday remains the issuer of the stamp.
Adversarial testing doesn't answer whether oversight, data handling, and audit trails have been assessed against governance standards. That's the axis OneTrust will open.
A stamp tells you an agent was tested, but it doesn't tell you who the business champion is or where the costs belong. That's the gap Agent Owners closes in ASOR, generally available later this month.
Every agent is assigned to named contacts: a business owner who uses the agent to drive value and owns the cost center it bills to, and a technical owner responsible for its configuration and support. You define the roles so they match how your organization works, and each owner's access is scoped strictly to the agents they're assigned, replacing the all-or-nothing agent admin model.
Passport gives you the evidence of testing. Agent Owners give you clear visibility into resource allocation and business sponsorship. Together, they give you tools to understand what an agent is doing, who is championing its use, and which department is funding it.
A stamp tells you an agent was tested, but it doesn't tell you who the business champion is or where the costs belong. That's the gap Agent Owners closes.
Agent Passport fits into the vendor and compliance ecosystems customers already have, instead of asking them to build a new one from scratch. Rather than running a separate review for every new agent, you can leverage the testing that was already done by the developer. That frees your existing security and compliance investments to focus on the decision that matters: should this agent get access, or not?
We recently laid out the three paths for building agents on Workday: host your own agent on Workday's Agent-Ready Tools, run a Workday agent behind the interface you already use (Copilot, Gemini, or your own), or work inside Sana. However you choose to build an agent, it’s held to the same standard.
That's because Agent Passport and Agent Owners are enforced inside Workday, where the rules already live, not bolted onto whatever interface the user happens to be working in.
The architecture underneath all of this hasn't changed: governance only holds when it's enforced at the same source of truth that already runs your payroll and your org chart, not layered on top of it from outside. Cisco provides independent assessments today, and Straiker and OneTrust plan to join, which will make the evidence feeding into Agent Passport richer and ensure it comes from an assessor you already trust.
So here are the questions I'd bring back to your team. When your agent takes an action, who authorized it, against what data, and where exactly is that recorded? Who tested or assessed it, and to what standard? And who owns it, and where does it sit in your organization?
The network of independent assessors is growing. We're already in conversations about who joins next, on both the testing side and the governance side. Stay tuned for more.
More Reading
Workday is opening its platform to every builder. Build your first enterprise agent in minutes with Developer Agent, get your own development tenant (beta), and build your career and business in a thriving global ecosystem.
Developer Agent, Custom Agents, and Agent-Ready Tools are now generally available as part of Workday Extend AI—a comprehensive developer toolkit to build and run agents lawfully inside Workday’s guardrails.
Today, Workday is announcing Workday Data Cloud, a new architecture that opens the System of Record directly to AI agents—which means teams no longer have to extract data, duplicate it, or rebuild security.
