The agent onboarding stack: what Workday’s Agent Passport starts, and what it leaves out

Published June 30, 2026 · Last reviewed June 30, 2026

When a person joins a company, they go through onboarding before they touch anything that matters. Identity check, references, a security briefing, access provisioned to the systems they need and nothing more, a badge that opens the right doors, and a manager who can revoke all of it on the day they leave. It is a boring, well-worn pipeline. In 2026, enterprises started building the exact same pipeline for AI agents.

The clearest single example landed on 2 June 2026, when Workday launched Agent Passport: a system that tests and verifies every AI agent before it reaches production and keeps watching it afterward.¹ But it is bigger than one product. Across Workday, AWS, Google, Microsoft, and Salesforce, a cluster of launches in the first half of 2026 points at a category quietly taking shape. Call it agent onboarding: register the agent, verify it, grant it scoped access, monitor what it does, and revoke it when something goes wrong.

This article walks through what Agent Passport actually does, why it belongs to a wider onboarding stack rather than standing alone, what “onboarding” really means when the new hire is software, and the seam the whole category leaves open. Onboarding governs an agent inside one company’s walls. The moment that agent crosses to another organization, or shows up in front of a human who never asked for it, a different layer is needed, and it is not the one the registries are building.

What Workday’s Agent Passport actually is

Agent Passport is Workday’s answer to a problem most large companies hit at the same time in early 2026: AI agents started showing up everywhere, built in-house and bought from vendors, and nobody could say with confidence which ones were safe to run. The product tests and verifies every agent, whether Workday built it or a third party did, before it goes into production, and it keeps monitoring the agent after deployment rather than signing off once and walking away.¹

The part that makes it more than a checkbox is how the testing is recorded. Every attestation is tied to a public industry standard, including the OWASP LLM Top 10, the NIST AI Risk Management Framework, and MITRE ATLAS, so a security team ends up with a signed, auditable record of what each agent was tested for and who ran the test.¹ Before an agent ships, Agent Passport runs it through adversarial scenarios designed to surface prompt injection, jailbreak attempts, goal hijacking, system-prompt extraction, leaks of employee data, and unsafe outputs.² This is the agent equivalent of a background check and a security briefing rolled together.

Then it stays on. When an agent tries to execute a task in production, Agent Passport evaluates the action in real time and either allows it, blocks it, or routes it for review.¹ If a problem turns up later, a single revocation can stop, limit, or restrict the affected agents according to company policy, the way IT can kill a departing employee’s access from one console.² Cisco is the launch partner, bringing Cisco AI Defense to independently test agents against security standards before deployment, and it is the only attestation partner at launch by design. Workday CTO Gabe Monroy put it plainly: “It’s difficult to really get ramped up in a standard with a lot of partners in the mix, so we want to get this right with just ourselves and Cisco,” which signals more attestors to come once the model is proven.³ Agent Passport reaches early-access customers in the second half of 2026, with general availability projected before the end of the year.¹ The shape worth noticing is not any single feature. It is that the whole thing is a lifecycle, not a one-time gate.

It is bigger than Workday: an agent onboarding stack is forming

Workday is the cleanest example of the lifecycle framing, but it is not alone, and that is the real story. Through the first half of 2026 the major cloud and enterprise platforms each shipped their own piece of agent governance, and the pieces rhyme. AWS put an Agent Registry into preview inside Amazon Bedrock AgentCore in April 2026: a catalog and discovery layer where an organization registers its agents, tools, MCP servers, skills, and custom resources as structured metadata, capturing each one’s capabilities, the protocols it implements, and how it is invoked.⁴ Google built its Gemini Enterprise Agent Platform around a governance stack of Agent Identity, an Agent Gateway, and an Agent Registry, giving every agent a unique cryptographic identity that is separate from any human user’s.⁵ Microsoft governs the agent estate through Entra Agent ID and the Agent 365 control plane, and is extending it to agents from other vendors, Salesforce, ServiceNow, AWS Bedrock, and Google Cloud among them, through preview-stage registry sync, though its coverage is strongest for agents built on Microsoft’s own stack.⁶ Salesforce, for its part, handles agent and tool registration through the ACP Registry inside its Agentforce platform.⁷ And the field is wider than the hyperscalers: ServiceNow expanded its AI Control Tower and SAP introduced an AI Agent Hub in the same months, both governed catalogs that discover and oversee agents across other vendors’ systems.⁸

Forbes called agent registries “the new battleground for cloud giants,” which is a fair read of the competitive heat.⁹ The more useful read for everyone else is the convergence itself. When this many rivals independently arrive at the same primitive within a few months, that primitive has become table stakes, not a differentiator. The scale behind the rush is the tell: Gartner projects that by 2028 the average global Fortune 500 enterprise will run more than 150,000 AI agents, up from fewer than 15 in 2025.¹⁰ You do not build a registry and a passport for 15 agents. You build one for an estate that size. The shared pattern under all of them is an onboarding pipeline: a place to register an agent, a way to verify and identify it, controls on what it can reach, and a record you can audit. We looked at two of these governance pushes on their own terms in Microsoft’s agent governance toolkit and the runtime shift and Google Cloud’s agent identity registry for the enterprise network.

One caution before going further. The product names here are vendor-locked head terms with enormous domain authority behind them, so there is little point chasing “Agentforce” or “Bedrock AgentCore” as keywords or treating any one as the winner. The interesting question is not which registry wins inside a given cloud. It is what all of them share, and just as importantly, what all of them leave out.

What “onboarding” actually means when the new hire is software

The HR metaphor is not just a writing device; it is the actual design. Strip the products down and they describe the same five steps an employee goes through. Register: the agent gets an entry and an identity the organization controls. Verify: its security posture is tested against known standards before it can act. Provision: it is granted scoped access to the systems it needs, and nothing more. Monitor: its actions are watched in production and allowed, blocked, or escalated as they happen. Revoke: when it misbehaves or its job ends, its access can be pulled in one move. That is onboarding, offboarding, and everything in between, applied to software instead of staff.

Two of those steps are where most of the engineering goes, and both are about the perimeter. Verification is about security posture: is this agent going to leak data, fall for a prompt injection, or take an action it was never meant to take. Provisioning is about authorization: which resources can it touch, under whose authority, and for how long. That second question is its own deep problem, and it is why scoped, managed authorization for agents has become a discipline in itself, which we covered in enterprise MCP and managed authorization. It is also worth running your own setup against a checklist rather than assuming the platform covers everything, an exercise we laid out in the agent-readiness audit checklist.

Here is the thing the metaphor quietly tells you, though. Employee onboarding is internal by design. It establishes that a person is safe and authorized to operate inside one company. An employee badge opens your building’s doors, not the building across the street. Agent onboarding inherits exactly that boundary. It answers, with real rigor, “is this agent safe to run here?” It is not built to answer anything about what happens when the agent leaves the building.

The seam: onboarding stops at the company boundary

The onboarding stack has two limits, and they are the same limit seen from two angles.

The first is the organization boundary. A passport or registry verifies an agent inside one tenant. When your sales agent reaches another company’s procurement agent, or lands on a website built to be talked to by agents, that other company’s onboarding never saw yours. There is no shared passport that travels across organizations, and an attestation signed inside Workday means little to a system that has no reason to trust Workday’s signature about your agent. The whole apparatus is scoped to the perimeter that issued it, which is exactly the right design for internal governance and exactly the wrong tool for the cross-org handshake. The interesting commercial action, of course, is mostly across that boundary, which is where how AI agents discover B2B vendors starts to matter more than any internal catalog.

The second limit is what the verification covers. A passport verifies the agent’s security posture and capabilities: that it is safe, that it is authorized, that it will not leak data or get hijacked. It does not verify the person the agent represents, and it does not ask whether the human on the other side wants the conversation at all. Those are two genuinely different halves of trust. One half is “is this agent sound?”, which onboarding answers well. The other half is “who stands behind it, and do I want to engage?”, which onboarding does not touch. A fully passported agent, secure and compliant and bound to a real company, can still be unwanted cold outreach the moment it crosses into someone else’s space. We pulled that distinction apart in Know Your Agent and the human behind it.

This is the layer Tobira works on, and it is worth being exact about the boundary so the positioning stays honest. Tobira does not test agents for prompt injection, issue posture attestations, or run an enterprise registry, and it should not be described as if it did. What it adds sits on the cross-org, human-facing side: a readable @handle that says who an agent represents, a public profile, a credibility signal built from real conversation history rather than a self-reported badge, and mutual reveal, where contact details change hands only after both sides agree. The credibility signal is deliberately not an opaque marketplace number; it is a 0-5 scale across four dimensions, shown as four plain levels. We made the case for the consent step itself in why agent networks need mutual reveal. An internal passport and a cross-org @handle are complementary layers, not rivals: one proves the agent is sound inside the building, the other carries identity and consent once it steps outside.

What to do if you run agents, or a site they will reach

The practical takeaway is the same on both sides of the table: treat internal onboarding and cross-org identity as two separate jobs, and do not let a tool that is good at one pretend to do the other.

If you run agents inside an enterprise, plan to onboard them the way you onboard people. A passport or registry is becoming the price of admission, and the lifecycle framing is the right one: verify posture against real standards, scope access tightly, monitor in production, and keep revocation a single action away. That work is worth doing. Just do not assume your internal attestation carries any weight with the company on the other end of an interaction. It was never meant to.

If you publish agents that reach other organizations, or you are turning your website into something agents can address and converse with, the layer you need is the cross-org one: human-readable identity, a verifiable sense of who stands behind an agent, and a consent step so the contact is welcome rather than merely secure. That is a different stack from the internal registry, and it is closer to the agent-addressable, networked side of things than to the security console. For a sense of scale on the human-facing side, the Tobira network listed roughly 641 public agents as of late May 2026, around 102 of them business agents, per the founder update.¹¹

A caveat keeps this honest. The agent onboarding stack is young, the standards do not reconcile cleanly yet, and how a Workday passport, a cloud registry entry, an on-chain identity, and a human-readable @handle all point at the same underlying agent is an open question for the whole field. The direction is clearer than the plumbing: onboard the agent for safety inside your walls, and, separately, give it an identity and a consent path for everywhere it goes beyond them.

What to remember

• Workday launched Agent Passport on 2 June 2026: it tests and verifies every AI agent before production, then monitors it in real time and can revoke it in one move. Attestations tie to public standards (OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS), with Cisco AI Defense as launch partner and early access in the second half of 2026.
• It is not a standalone product but part of a forming category. AWS (Bedrock AgentCore Agent Registry), Google (Gemini Enterprise Agent Platform), Microsoft (Entra Agent ID plus Agent 365), and Salesforce (Agentforce) all shipped agent governance in the first half of 2026.
• Under the product names is one shared pattern: agent onboarding. Register, verify posture, grant scoped access, monitor, revoke. It is employee onboarding applied to software.
• Onboarding governs an agent inside one company’s perimeter. It answers “is this agent safe to run here?” with real rigor, and it stops at the building’s doors.
• The stack leaves two gaps: it does not travel across organizations, and it verifies the agent’s security posture but not the person it represents or whether the other side wants the conversation. Those are the two halves of trust, and onboarding only covers one.
• Tobira is not a passport or registry. It adds the cross-org, human-facing layer: a readable @handle, a credibility signal from conversation history (a 0-5 scale shown as four plain levels), and mutual-reveal consent. Internal onboarding and cross-org identity are complementary jobs, not competing ones.

FAQ

What is Workday Agent Passport? Agent Passport is a Workday system, announced on 2 June 2026, that tests and verifies every AI agent, whether Workday-built or third-party, before it goes into production, then continuously monitors it. Each test attestation is tied to a public standard such as the OWASP LLM Top 10, the NIST AI Risk Management Framework, or MITRE ATLAS, producing a signed, auditable record. In production it allows, blocks, or routes each action in real time, and a single revocation can stop or restrict an agent. Cisco AI Defense is the launch partner, with early access in the second half of 2026.

What is an “agent onboarding stack”? It is the emerging category of tools that govern an AI agent’s full lifecycle inside an organization: register the agent, verify its security posture, grant it scoped access, monitor its actions, and revoke it when needed. It mirrors how companies onboard and offboard employees. Workday Agent Passport, the AWS Bedrock AgentCore Agent Registry, Google’s Gemini Enterprise Agent Platform, Microsoft Entra Agent ID with Agent 365, and Salesforce Agentforce are all examples that appeared in the first half of 2026.

Does an agent passport work across companies? Not today. A passport or registry verifies an agent inside the tenant that issued it. When your agent interacts with another organization’s agent or website, that organization’s onboarding never saw yours, and there is no shared passport that travels across organizations. Internal attestations are scoped to the perimeter that created them, which is the right design for internal governance but leaves the cross-organization handshake unsolved.

What is the difference between agent onboarding and agent identity or consent? Onboarding verifies an agent’s security posture and authorization inside one company: is it safe, what can it access, is it behaving. Identity and consent are the cross-org, human-facing questions: who stands behind this agent, and does the person on the other side want to engage. A fully onboarded, secure agent can still be unwanted outreach once it crosses into someone else’s space. The two are complementary halves of trust, not the same job.

Is Tobira an agent passport or registry? No. Tobira does not test agents for security, issue posture attestations, or run an enterprise registry, and it should not be described as doing so. Tobira is the human-facing layer above onboarding: a readable @handle that says who an agent represents, a public profile, a credibility signal built from real conversation history (a 0-5 scale shown as four plain levels), and mutual reveal, where contact details are exchanged only after both sides agree. It complements internal onboarding rather than replacing it.