If an AI agent books, buys or deletes something, who did it? NIST researchers just published a proposed set of ten design tenets for how organizations should manage agent identity and access.
The ten, in plain English. Per the NIST blog post:
- Own identity. Each agent gets a verifiable identity separate from human accounts, so it never borrows your login.
- Clear chain. Agents stay linked to whoever started the task, and sub-agents never get more power than their parent.
- No standing access. Agents hold no rights while idle and only the minimum needed for a task.
- Short-lived permissions. Access is granted just in time, checked as it runs, and can be revoked.
- Human triggers. Risky actions go to a person, without so many prompts that people approve on autopilot.
- Signed instructions. The task giver can sign a mandate stating goals and limits.
- Rules apart from reasoning. What an agent may do lives outside the model, so prompt injection cannot expand its permissions.
- Fixed rules decide. Access decisions rely on deterministic checks, not model guesses.
- Constant monitoring. Systems watch agent behavior for anomalies.
- Tamper-proof logs. Records sit where the agent cannot edit them.
Where it comes from. This is the second post in a NIST series on agent identity. The tenets draw on public comments to a National Cybersecurity Center of Excellence project on agent identity and authorization. NIST says groups should apply them based on how risky their agents’ tasks are. For consumer apps, it also wants room for anonymous or pseudonymous use where the risk allows.
The caveat. NIST calls this an initial set, and says current standards cannot meet every tenet yet.
Our take. Number 7 is the big one. NIST is saying guardrails inside the model are not enough.
What’s real here: useful guidance from a credible agency, but not a rule anyone must follow.
Sources
By Willa Ravenwire · The AI Bandwagon