Ten design tenets that current standards do not yet fully cover, and that NIST puts forward as the starting point for its upcoming SP 1800 guide. All of them start from the same premise: an agent cannot be held accountable for its actions while it operates with the credentials of the person who launched it.
An AI agent querying a customer database today usually does so with the credentials of the person or system that launched it. The session log shows that user, not the agent, so there is no way to attribute the agent’s actions to it. The Medicare case, in which an AI agent accessed data from a public system without permission, shows how hard it is to detect in time.
When an operation goes wrong, the organization needs to be able to say who acted, on whose behalf and with what authority, yet the log cannot tell the agent apart from the user whose credentials it used. The evidence has to be reconstructed after the fact, manually and with no guarantees.
NIST now proposes a first framework, and its starting point is to treat the agent as an entity with its own identity: unique, cryptographically verifiable, distinct from human users and service accounts (what the industry calls non-human identities, or NHI), and with its own lifecycle. The other nine tenets build on that foundation. In practice, it is the basis of what the market already calls Know Your Agent (KYA): verifying the agent with the same rigor used to verify the customer.
The document, Design Tenets for Agent Identity Management Systems, was published on October 27, 2026. It is authored by Harold Booth, Bill Fisher and Ryan Galluzzo (NIST) together with Tom Clancy (MITRE), and it is the second installment in a series on agentic identity. It is part of the NCCoE project (NIST’s National Cybersecurity Center of Excellence) to accelerate the adoption of software agents, whose February concept paper drew more than 600 comments. The end goal is a guide in the SP 1800 series, the format NIST uses to publish practical guides with reference implementations.
NIST’s 10 design tenets for AI agent identity
NIST presents these agentic identity tenets as an initial set and a starting point, not as a finished standard:
- Distinct agent identification. A cryptographically verifiable identity, separate from people and service accounts, with its own lifecycle.
- Agent linking, delegation and attenuation. The agent stays bound to whoever launched it, and delegated authority can only narrow as it passes to other agents or services.
- Least and zero standing privilege. No permissions while idle, and only the minimum scope each task requires.
- Short-lived, dynamic and revocable authorization. Just-in-time permissions that expire, are verified at runtime and avoid long-lived credentials.
- Human-in-the-loop triggers. Risk thresholds that bring in a person with enough context to decide.
- Mandates and constraints. Signed mandates that define the intended outcome and that downstream services can verify.
- Separation of policy from reasoning. What the agent decides to attempt and what it is allowed to do live in separate systems.
- Deterministic access decisions. Probabilistic signals inform the decision but never make it on their own.
- Continuous monitoring. Agent-specific metrics and thresholds to detect anomalous behavior at machine speed.
- Immutable evidence. A tamper-evident record of the agent’s identity, delegated intent and actions, kept beyond its reach.
Delegated authority cannot expand along the way
The next three tenets define what the agent can do with that identity. The first requires the agent to remain cryptographically bound to the person or organization that launched it for the entire task, and the authority it receives, including any it passes on to other agents or services, can never exceed that of its source. The second removes standing privileges: the agent keeps no permissions while idle and receives only the minimum scope each task requires. The third limits authorization in time. Permissions are granted at the moment the task begins (just-in-time), expire, can be revoked and are verified during execution, with no long-lived credentials that anyone could reuse. This tenet is what separates a legitimate operation from an unauthorized one when AI agents act on behalf of your customers.
With this, NIST addresses two problems that risk teams already know from human users, accumulated privilege and stolen credentials that keep working, and one specific to agents: the “confused deputy” attack, in which an injected instruction leads an agent with broad permissions to carry out an action it should not. It is the scenario we analyze in rogue AI agents.
Access policy cannot live inside the model
The seventh tenet has the greatest architectural implications. A language model receives data and instructions through the same channel, and a malicious instruction hidden in a document could expand the agent’s permissions. For this reason, NIST requires access policy enforcement to be separated from the agent’s reasoning, and warns that “guardrails alone are insufficient.” The eighth tenet completes the picture: access decisions are made with deterministic controls, and probabilistic signals inform the decision but never make it on their own.
The remaining four tenets round out the framework with risk thresholds that trigger human review, signed mandates that define the intended outcome, like those the AP2 protocol already uses in agentic payments, continuous monitoring adapted to the speed at which agents operate, and tamper-proof logs kept out of the agent’s own reach.
NIST acknowledges that current standards and technology do not yet cover all the tenets, and recommends building a roadmap that applies each one according to the risk of the agent’s transactions and the data it accesses.
What this means for fraud and risk teams
The ten tenets describe, in the language of identity, what we already know about fraud: if an operation cannot be attributed to a specific identity, there is no usable evidence. The first step for a risk team is to check whether its agents have their own identity, whether their permissions can be revoked mid-task and whether their logs sit beyond their reach. Who approves and oversees those permissions inside the organization is the other half of the problem, which we cover in AI agents and the new role of the CISO. At Facephi, we work on that premise, bringing together the full context of an identity and its operations history in a single platform, so that attribution and evidence do not depend on reconstructing sessions after an incident.
FAQ about the NIST agent identity tenets
They are ten tenets that NIST, together with MITRE, proposes for managing the identity, authentication and authorization of AI agents. They start from giving each agent its own verifiable identity and cover delegated authority, permissions, human review, monitoring and evidence retention.
No. NIST presents them as an initial set and a starting point. They will guide the NCCoE demonstrations and a future guide in the SP 1800 series, and NIST itself acknowledges that current standards and technology cannot yet meet all of them.
Know Your Agent (KYA) applies the logic of KYC to AI agents: knowing which agent is acting, on whose behalf and with what permissions. The NIST tenets describe the identity and authorization requirements that make that control possible.
