News
White Paper
The Future of Leadership Development: AI-Driven Manager Enablement
In Brief
- Agent Passport tests and verifies every agent against public security standards before deployment, then monitors continuously afterward.
- Developer Agent and Agent-Ready Tools give developers a governed path from idea to working agent without compromising HR and finance data.
- Security leaders gain auditable, comparable validation that reduces risk and compliance gaps.
At its annual developer conference in Las Vegas this week, Workday unveiled Agent Passport, a system that requires every AI agent to pass independent security testing before it touches production data, then monitors it continuously after deployment. It's a direct response to a problem nobody has a clear answer to yet: how do you know whether an agent is safe to let loose on your HR and finance data?
Each agent gets a signed, auditable record of what it was tested for and by whom, tied to established public standards including OWASP LLM Top 10, NIST AI RMF and MITRE ATLAS. Cisco is the launch partner, bringing its AI Defense capability to do the independent vetting.
Agents are going to be everywhere in the enterprise, and that only works if security teams have a clear, signed record of what each one has been tested for.
- DJ Sampath, Senior Vice President and General Manager, AI Software and Platform,
Cisco
Agentic AI deployments have outpaced the governance structures meant to keep them in check. Many organizations are distributing API keys and OAuth tokens to agent vendors with no real visibility into what those agents can do once they're in. One misconfigured agent sitting on top of payroll or benefits data is all it takes for a missed paycheck, an exposed employee record or a call from a regulator.
Gartner projects agentic AI will handle 15% of daily autonomous decisions by 2028. The accountability infrastructure to support that isn't there yet. Agent Passport is Workday's attempt to start building it.
Workday Makes Agents Easier to Build — and Harder to Break Things With
Agent Passport wasn't the only announcement out of DevCon today. Workday also shipped two tools aimed at the developers tasked with building these agents.
The first, Developer Agent, lets developers describe what they want to build in plain language from inside the tools they already use — Claude Code, Cursor, Cline, Codex, Google Antigravity — and get working Workday-compatible code back.
The second, Agent-Ready Tools, handles the data access. It gives agents governed access to HR and finance data via Model Context Protocol, with Workday's business logic and compliance rules intact. The guardrails travel with the data, whether the agent is customer-built, third-party or Workday's own.
Both tools are in early access now through Workday Extend Professional, with general availability expected in the second half of 2026. Agent Passport follows the same timeline, with broad availability before year-end.
Overview of Workday's DevCon Announcements
Here's a quick breakdown of the three tools and their capabilities announced today in Las Vegas:
| Capability | Description |
|---|---|
| Developer Agent | Build AI apps and agents in plain language from tools like Claude Code, Cursor, Cline, Codex, and Google Antigravity |
| Agent-Ready Tools | Governed access to HR and finance data via MCP, with Workday's business logic and compliance rules built in |
| Agent Passport: Pre-production testing | Agents tested against risks including prompt injection and data leakage before deployment |
| Agent Passport: Public standards alignment | Attestations tied to OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS |
| Agent Passport: Independent attestation | Signed test results from verified partners, starting with Cisco AI Defense |
| Agent Passport: Real-time monitoring | Agent actions allowed, blocked, or routed based on ongoing behavior post-deployment |
| Agent Passport: Single-click revocation | One action stops or restricts affected agents per company policy |
A Company Mid-Transformation
All of this happens during an equally ambitious and bumpy period for Workday. The company has acquired five businesses since late 2024 — among them conversational hiring AI Paradox, AI-native knowledge platform Sana Labs for $1.1 billion and low-code integration platform Pipedream, which adds over 3,000 connectors to tools like Asana, HubSpot, Jira and Slack. Co-founder Aneel Bhusri returned as CEO in February, stepping back in after Carl Eschenbach's departure.
The buying spree is directly related to today's agent governance announcement. More connectors mean more surfaces where agents can act, which increases the pressure to understand which agents you can trust.
Conference
Jun
2
Gartner Application Innovation & Business Solutions Summit Las Vegas 2026
Register
Webinar
Jun
17
Engaged, But Not Convinced: What's Eroding Beneath Your Strongest Engagement Numbers
Perceptyx EX Benchmark '26: leadership trust, change confidence and conviction gap truths at large enterprises.
Register
Webinar
On demand
Retention Is a Communication Problem: New Data from 6,000+ Employees
This session gives leaders a clear diagnosis and practical path to treat retention as an infrastructure problem.
Watch Now
Webinar
On demand
Do Learning Programs Really Work? How to Turn Education Into Engagement In Healthcare
See how leaders are using learning programs to build trust with healthcare professionals and create measurable engagement.
Watch Now
The company has also been navigating some harder news: roughly 400 layoffs in February, two federal class action lawsuits — one alleging its AI hiring tools discriminated against applicants over 40, another connected to a 2025 data breach — and the scrutiny that comes with being a major player in the AI hiring space at a moment when that space is under a microscope.
For HR and digital workplace leaders, the DevCon announcements suggest Workday believes the next competitive advantage in enterprise AI won't just be which platform has the most capable agents, but which one can show you they are safe to deploy. Workday wants to be ready with an answer as more organizations start to ask that question.
Have a tip to share with our editorial team? Drop us a line: