NIST's design tenets for AI agent identity and authorization

Where the NIST work stands

NIST's Computer Security Resource Center lists the concept paper "Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization" with a published date of February 5, 2026, and its page states that comments were due April 2, 2026 and that the public comment period is closed.

NIST's announcement of September 29, 2026 says the concept paper received an exceptional level of engagement, with feedback from more than 600 commenters across industry, government, and academia.

The same announcement says that, based on that feedback, the NCCoE's Secure Software Development (DevSecOps) project will provide the first implementation use case, to demonstrate how AI agents can be identified, authenticated, and authorized within the software development lifecycle.

A NIST blog post dated October 27, 2026 then proposes an initial set of ten design tenets, which the authors say focus on defining a vision for identity and access management systems that manage agents across both enterprise and consumer-facing use cases.

The rest of this guide follows those documents in order: the concept paper's framing first, then the tenets grouped by what they control.

What the concept paper and the standards initiative say

The concept paper page says that realizing the benefits of AI agents requires understanding the potential risks from giving them access to diverse data sets, tools, and applications, and applying appropriate identification and authorization controls to mitigate those risks.

NIST's AI Agent Standards Initiative page, last updated August 14, 2026, says NIST conducts fundamental research into agent authentication and identity infrastructure to enable secure human-agent and multi-agent interactions.

The concept paper sets the problem and the research strand names the topic. The ten tenets in the October 27, 2026 post give the detail, and the sections below walk through them.

Identifying agents and tracing their authority

Tenets 1 and 2 deal with who an agent is and on whose behalf it acts.

Tenet 1, Distinct Agent Identification, says agentic infrastructure enables unique, cryptographically verifiable identification of agents that is distinguishable from other identities such as human users and service accounts, and adds that ideally this identity is tied to a specific workload, environment, and approved configuration.

Tenet 2, Agent Linking, Delegation & Attenuation, says that to maintain a clear chain of trust, agents and the entities that initiate their tasks are cryptographically linked throughout the agent execution.

The same tenet says that as authority is delegated down to sub-agents or downstream services, scopes attenuate so that downstream entities can never claim more authority than the parent.

Limiting access: privilege, grants, policy and decisions

Tenets 3, 4, 7 and 8 set out how access is granted and how it is decided.

Tenet 3, Least & Zero Standing Privilege, says agents operate with zero standing privilege and hold no persistent rights when idle, with access bounded to the minimum scope needed for a designated task and constrained by Separation of Duties so an agent cannot assume conflicting privileges that bypass governance controls or take unintended actions.

Tenet 4, Short-Lived, Dynamic & Revocable Authorization, says all access grants are Just-In-Time, time-bounded and audience-specific, and that each tool invocation, API call, or resource access should undergo continuous runtime verification based on current state, environmental context, and risk profile.

Tenet 7, Architectural Separation of Policy from Reasoning, comes with a rationale stating that the separation must be enforced by architecture design to establish policy enforcement around the agent and between the systems, data, credentials, and environments it interacts with, and that guardrails alone are insufficient.

Tenet 8, Deterministic Access Decisions, says organizations maintain deterministic capabilities as the primary mechanism for access decisions in agentic scenarios, and that probabilistic information can be an input but is not the primary mechanism for access determinations.

Oversight, mandates, monitoring and evidence

Tenets 5, 6, 9 and 10 cover how agent actions are reviewed, bounded and recorded.

Tenet 5, Human-in-the-Loop Triggers, says every organization defines risk thresholds and tolerances that initiate human review of agentic actions when reached, and that these are supported by technology components able to trigger escalation to the correct authority.

Tenet 6, Mandates and Constraints, says the originator of an agent's task can create cryptographically signed mandate statements that define intended outcomes and constraints, and that these may be generated when the agent is tasked, built into enterprise configuration, or established through organizationally defined templates.

Tenet 9, Continuous Monitoring, says agents operate at a scale and velocity that is not achievable for humans and even most deterministic automation, so systems monitor agentic access and provide detection and warnings of potentially anomalous behavior.

Tenet 10, Immutable Evidence, says the logging infrastructure is independent of the agent to prevent modification, enabling analysis for drift, anomalous behavior, and overall agent performance.

Applying the tenets together

The post says tenets should be applied by organizations based on the risk of the agentic transactions they intend to support, the environment in which they operate, and the data, tools, and skills the agents interact with.

The post also says that more than one tenet may be needed against a single threat. Its example is the "confused deputy" attack, where it says effective prevention also requires Least Privilege, Architectural Separation of Policy from Reasoning, and Deterministic Access Decisions alongside linking and delegation.

The authors state that not all of the tenets will be immediately fulfilled by the current state of standards and technology.