Authors at the U.S. National Institute of Standards and Technology have proposed 10 design tenets for systems that manage the identity, authentication and authorization of AI agents, starting from the position that each agent should be uniquely and cryptographically identifiable rather than borrowing a human’s or service account’s identity.
The tenets appear on NIST’s Cybersecurity Insights blog, written by Harold Booth, Bill Fisher and Ryan Galluzzo of NIST and Tom Clancy of MITRE. They draw on public comments and stakeholder engagement in a National Cybersecurity Center of Excellence (NCCoE) project on agent identity and authorization. The authors call them an initial set, covering enterprise and consumer-facing uses, to be applied according to the risk of the transactions involved.
The first tenets address who an agent is and for whom it acts. Agents would have an identity, credential and access lifecycle distinct from human users, and would be cryptographically linked to the person or organization that initiated their tasks, the aim of products such as Shufti’s Know Your Agent. Authority delegated to sub-agents would narrow so that downstream entities never claim more than the parent. In consumer settings, implementations would support anonymous or pseudonymous transactions where appropriate, using privacy-preserving technology where available.
Others limit what an agent holds. Under zero standing privilege, agents keep no persistent rights when idle, and access is granted just in time for a specific task and audience. The authors warn against long-lived bearer tokens, which attackers can reuse if stolen. Organizations would set risk thresholds that trigger human review, designed with consent fatigue in mind so that approvals do not become habitual. Task originators could also issue cryptographically signed mandates defining an agent’s intended outcomes and constraints.
Two tenets target prompt injection, in which malicious instructions hidden in data manipulate an agent. The systems deciding what an agent is allowed to do would be architecturally separated from the model deciding what it attempts, and deterministic checks, not probabilistic ones, would remain the primary basis for access decisions. “Guardrails alone are insufficient,” the authors write. The final tenets call for monitoring built around agent-specific metrics and for tamper-evident, append-only logs kept independent of the agent.
The first post in the series warned that people giving agents their own credentials has become a common pattern and creates accountability gaps. Proof’s x401 protocol, launched last month, lets a website ask an agent to prove which verified person it is acting for.
The authors say not all of the tenets can be met immediately with current standards and technology. They will serve as guideposts for the NCCoE’s agent demonstrations, which will examine how standards and technology can satisfy them across enterprise and consumer uses.
Sources: NIST, NIST Cybersecurity Insights
–
By the ID Tech Editorial Team
