AI Agents Need Passports Before They Get Access
2026-06-03 · 4 min read · Janaina Maia
The most useful AI product announcement this week is not another agent that can do more. It is a sign that enterprise platforms are starting to ask a better question: how do we know which agents are safe enough to let into sensitive workflows?
Workday announced new tools for developers to build, connect, and verify AI agents for HR, finance, and IT. The part I find most important is Agent Passport, a system designed to test, verify, and continuously monitor agents before they can operate inside Workday. The passport records whether an agent has been tested against public standards such as OWASP LLM Top 10, NIST AI Risk Management Framework, and MITRE ATLAS, and it can allow, block, route, or revoke agent actions based on policy.
That sounds like infrastructure. I think it is also a design pattern.
Agents need credentials, not just capabilities.
Most AI agent demos focus on capability. The agent can write code, search documents, prepare a report, update a record, or complete a workflow. But capability is not the same as permission. A person can be skilled and still not be authorised to approve payroll, access employee records, or change financial data.
The same has to be true for agents. If an AI system can act inside HR or finance, the product needs a way to answer simple questions: which agent is this, who tested it, what risks were checked, what is it allowed to do, and how quickly can we stop it?
A passport is a useful metaphor because it turns invisible trust into something inspectable. It says, “this actor has been checked against these rules, by this party, for this type of movement.” Enterprise AI needs more of that.
Verification should be continuous.
One quiet problem with AI products is that behaviour can change. A model update, tool connection, prompt change, new data source, or malicious instruction can alter what an agent does. Testing once before launch is not enough when the system keeps moving.
This is why continuous monitoring matters. It treats the agent less like a static software feature and more like a semi-autonomous participant in the workflow. The product has to keep checking whether the agent is still behaving within its approved boundaries.
For design leaders, that means verification cannot sit only in a security dashboard. It has to shape the experience of delegation. Before a user asks an agent to act, the interface should make the agent’s authority and limits understandable in plain language.
The passport should be visible at the moment of trust.
Imagine an employee asks an AI agent to prepare a compensation change, or a finance user asks an agent to update a supplier record. The user should not need to understand every security standard behind the scenes. But they should understand the practical boundary: this agent can draft the change, it cannot approve it, it used these data sources, and this action requires human sign-off.
That is the product design opportunity. Turn technical attestation into visible trust cues. Not as decorative badges, but as useful information that helps people decide when to delegate, when to review, and when to stop.
Design implications.
- Show identity: make it clear which agent is acting and on whose behalf.
- Show authority: explain what the agent can see, change, approve, or never touch.
- Show verification: translate security testing into plain-language confidence, not opaque certification theatre.
- Show stop controls: give teams fast ways to pause, narrow, or revoke an agent when risk changes.
- Show accountability: record the instruction, evidence, policy decision, human approval, and final outcome.
My take.
The next stage of agentic AI will not be won by the product with the most enthusiastic assistant. It will be won by the products that make delegated authority legible.
Workday’s Agent Passport is vendor news, so I would not treat it as proof that the market has solved agent governance. But it points in the right direction. Enterprise agents need identity, verification, continuous monitoring, and revocation before they deserve access to sensitive work.
An agent without a passport is not a trusted coworker. It is automation asking to cross a border with no documents.