United States
NIST — cybersecurity and identity updates
AI, Technology & Data
✓ 23 claims
28 Oct 2026
NIST sets out ten design tenets for managing AI agent identities
NIST's National Cybersecurity Center of Excellence has published an initial set of ten design tenets for identity, authentication and authorization of AI agents. The post draws on public comments to an ongoing NCCoE project and will guide forthcoming demonstrations. For firms planning to deploy agents at scale, it signals the controls that emerging standards work is likely to coalesce around.
- NIST proposes that agents hold zero standing privilege, with access bounded to the minimum scope for a task and granted just-in-time, time-bounded and audience-specific.
- The logic determining what an agent attempts should be architecturally separated from the systems determining what it is allowed to do, because LLMs process data and instructions as a single token stream.
- Deterministic capabilities should be the primary mechanism for access decisions, with probabilistic information used only as input, to limit the impact of attacks such as prompt injection.
- Enterprises should maintain an independent, append-only, tamper-evident log of agent identity, delegated intent and resulting actions, kept outside the agent's reach.
- NIST states not all tenets can be met by current standards and technology and frames them as a roadmap for the NCCoE's planned agentic demonstrations.