Workday's Agent Passport: Finally, a Security Badge for AI Agents Touching Your HR Data

AI agents are now handling some of the most sensitive data in your organization — employee salaries, benefits, performance reviews. But until now, there was no standard way to verify those agents were actually safe before they went live. Workday just changed that. In this episode, we break down Agent Passport — Workday's new three-layer governance framework for AI agents. It covers pre-deployment testing against frameworks like OWASP's LLM Top 10 and NIST, continuous monitoring after go-live, and single-point revocation if an agent misbehaves. We also look at Cisco's role as the first independent validator — because self-certification just doesn't cut it anymore. We also touch on two companion tools Workday announced alongside Agent Passport: Developer Agent, which lets developers build Workday-compatible AI agents using plain language from their existing coding tools, and Agent-Ready Tools — MCP-based connectors that give AI agents governed access to HR and finance data. The big open question? Liability. Even with all this testing and monitoring, if an agent goes wrong, nobody has fully figured out who's on the hook. That's something every HR leader should be tracking closely as AI agents become standard infrastructure.