NIST Cybersecurity Insights publication, October 27, 2026
NIST Proposes Ten Design Tenets for AI Agent Identity: Distinct Identities, Revocable Delegation, Human Review
NIST published an initial set of ten design tenets for AI agent identity management systems on October 27, in a Cybersecurity Insights post presenting proposed technical principles for how agents receive identities, exercise delegated authority, and remain subject to oversight in enterprise and consumer-facing deployments. The tenets, as summarized in coverage of the publication, cover giving each agent a distinct identity rather than letting it act under a person identity, constraining delegation to the task at hand, least privilege, authorization that can be revoked, triggers for human review, keeping policy enforcement separate from the agent own reasoning, monitoring, and independent evidence of what the agent did. NIST is explicit about the limits: this is a blog presenting proposals, not a standard, a mandate, or a certification checklist, it sets no effective date or deadline, and NIST acknowledges that current technology and standards may not immediately fulfill every tenet. The central design message is contextual: authorization should be sized to transaction risk and deployment context, so an agent that retrieves internal information and an agent permitted to initiate a business transaction should not carry the same permissions, approval points, or evidence requirements. The audience NIST writes for, identity and access management owners, security architects, AI deployment leads, procurement teams, and internal reviewers, is the same group that will be asked by customers and auditors what identity an agent acted under and who could have stopped it.
Executives
Agents are starting to act under your organization authority, sending messages, changing records, and initiating transactions, and the first governance question is embarrassingly basic: under whose identity, and who can revoke it mid-task. NIST tenets give leadership a vocabulary for that question before any rule forces it. No deadline attaches to this publication, so the value is in using it now, while agent deployments are few enough to inventory on one page.
CIO / CISO
Run the tenets as a scoped review of one real deployment rather than a program launch: document the agent intended tasks, the systems it can reach, its accountable owner, the permissions delegated to it and where that authority ends, and the transactions that require a named human approver. Then test the two claims teams most often assert without evidence: demonstrate revoking the agent access while a task is active, and reconstruct one completed action end to end from the initiating request through the authorization decision to the resulting change. Record gaps in two groups, what you can fix now and what needs vendor capability, reflecting NIST own maturity caveat.
Engineers
Build to the testable parts first: a distinct, attributable identity per agent, short-lived and narrowly scoped credentials instead of shared service accounts, enforcement of permission boundaries outside the model reasoning loop so a persuasive prompt cannot widen its own access, and logs that a reviewer who was not present can follow. Where a platform cannot yet support a tenet, such as mid-task revocation, document that as a known limitation attached to the deployment approval rather than leaving it implicit.
Everyone (non-IT)
If an AI assistant at work sends mail or updates records on your behalf, it is reasonable to ask a simple question: does it act as you, or under its own clearly labeled identity that can be switched off. Systems that can answer that question clearly are the ones designed to stay under human control, and that design work is what this NIST publication is encouraging.