Cisco and Workday replace the questionnaire with an auditable "passport" for AI agents: a useful step, still without external testing

By Cisco Blogs · October 20, 2026.

Workday has opened Early Access to Agent Passport, a signed, auditable record of what has been verified about an AI agent, who verified it and against which standard. Cisco AI Defense is the launch evaluator: its adversarial testing backs the security "badges" for agents built by Workday. The announcement is written by two Cisco product executives, so the description comes from one of the interested parties.

According to Cisco, the roles are split like this: Workday defines the badges, Cisco tests the agents Workday builds against public standards, and Workday issues the badge that customers use to decide how to deploy each agent. The results include tests of resistance to prompt injection (when an attacker hides instructions in text the agent reads) and to jailbreaks (getting around the model's rules). They are mapped to the OWASP Top 10 lists, MITRE ATLAS and the frameworks of NIST, the U.S. standards institute. Agent Passport was unveiled in June at Workday DevCon.

The most interesting technical part is the method. Cisco argues that an agent can pass every question in a test suite and still leak data on the fifteenth turn of a conversation if an attacker shifts the context step by step. Its "adaptive red teaming" (an automated attack team) studies what the agent is for, which tools it can reach and what guardrails it has, works out which outputs it must never produce, and goes after them over many turns. Cisco illustrates this with a support agent that is talked into issuing a refund to the wrong person: it isn't a jailbreak, it is the agent doing its job for the attacker.

Cisco also pitches its product as covering the whole lifecycle: discovering unregistered agents and models, checking what they are built from, testing them before deployment and retesting them when they change, and enforcing guardrails in production. It adds that red-team findings are turned into guardrails that block them. All of this is the company's own claim; the post gives no effectiveness figures or specific test results.

**Our take.** The core argument is right: approving an agent based on a questionnaire and the vendor's word means judging something that changes from a single snapshot. Agents hold credentials, call tools and write to systems of record, so they deserve something closer to a continuous audit. Turning trust into a verifiable, signed, repeatable record is the kind of evidence-based governance we favor over panic-driven regulation.

The market as a whole is heading that way: as agents are bought through marketplaces, vendors and partners, customers will need a trust layer they can check. Cisco says so plainly, and it is right that every agent ecosystem will need this pattern.

But there are three caveats. First, for now Workday is assessing its own agents with an evaluator it picked. Real credibility will come when third-party agents are evaluated and the criteria are public and comparable. Second, a badge certifies what was tested up to a certain date, not that there are no flaws. The value lies in continuous retesting, which the post promises but doesn't spell out. Third, this is an approval approach, and we already know that approving is not the same as controlling. In our view of agentic security, solid protection comes from design: least privilege by default and limits the agent cannot bypass. A passport is useful if it determines which permissions an agent gets, not if it becomes just another box to click.

In the short term, this is compliance plumbing: unglamorous and necessary. In the long term, the abundance promised by agentic AI only arrives if companies dare to hand real work to agents, and they will only do so once they can show an auditor what was verified. Whether this infrastructure is built on open standards and independent evaluators, rather than as proprietary badges, will decide whether it builds trust or only the appearance of it.