An Initial Set, Not a Standard

On October 27, 2026, Harold Booth, Bill Fisher, and Ryan Galluzzo of NIST and Tom Clancy of MITRE published Design Tenets for Agent Identity Management Systems, the second post in a NIST Cybersecurity Insights series on agentic identity. The November 3 NCCoE News bulletin highlighted the post; it was not the original publication.

The authors call the ten tenets an "initial set" and a "starting point," drawn from public comments on the National Cybersecurity Center of Excellence (NCCoE) project behind the February concept paper and from stakeholder engagement. NIST's pages now use "Super Intelligence" in the project's name. This is a blog post, not a final standard or a NIST Special Publication. It sets no deadline or conformance test, and it asks organizations to apply the tenets according to risk. It also says "not all of these design tenets will be immediately fulfilled by the current state of standards and technology."

The tenets are to serve as "guideposts" for NCCoE demonstrations. The project hub names an SP 1800-series practice guide as the ultimate deliverable and accepts further comments by email. Its summary of more than 600 concept paper responses says a draft project description comes next.

What the Ten Tenets Say

  • Distinct identity. Tenet 01, Distinct Agent Identification, calls for unique, cryptographically verifiable agent identities that are distinguishable from human users and service accounts and have their own lifecycle.
  • Narrowing authority. Tenet 02, Agent Linking, Delegation & Attenuation, cryptographically links agents to the entities that task them, and scopes attenuate so that downstream entities "can never claim more authority than the parent." Tenet 03, Least & Zero Standing Privilege, leaves agents no persistent rights when idle. Tenet 04, Short-Lived, Dynamic & Revocable Authorization, makes access time-bounded and revocable.
  • Enforcement outside agent reasoning. Tenet 07, Architectural Separation of Policy from Reasoning, separates what an agent attempts from what it is allowed to do, and adds that "Guardrails alone are insufficient." Tenet 08, Deterministic Access Decisions, keeps deterministic capabilities as the primary access mechanism; probabilistic information can be an input.
  • Human review. Tenet 05, Human-in-the-Loop Triggers, has organizations define risk thresholds that initiate human review, give reviewers adequate information, and account for consent fatigue. It does not say that an approval must be bound to a specific action. A public comment on the post, from the founder of an authentication company, proposed that addition; it is not NIST's text.
  • Mandates and evidence. Tenet 06, Mandates and Constraints, lets a task originator create signed statements of intended outcomes and constraints that downstream services can verify. Tenet 09, Continuous Monitoring, covers agent-specific detection of anomalous behavior. Tenet 10, Immutable Evidence, calls for tamper-evident, append-only evidence of the agent's identity, delegated intent, and resulting actions, kept in logging infrastructure independent of the agent.

How a Working Group Draft Compares

A separate IETF document covers similar ground at the protocol level. The WIMSE working group posted draft-ietf-wimse-aims-01, "AI Identity Management System," on November 2. It is a working group document whose header gives Informational as its intended status and, like any Internet-Draft, is citable only as "work in progress." NIST's comment summary lists the earlier -00 revision among emerging work and says that listing implies no endorsement. The tenets post does not cite it, and the -01 text does not cite NIST. The comparison below is ours; we found no published mapping between the two.

The draft is more specific on two points. Section 10.8 says an agent "MUST NOT treat local UI confirmation alone as sufficient authorization" and requires such confirmation to be bound to a verifiable authorization grant. Section 11 lists minimum audit-event fields and says audit records "MUST be tamper-evident," but an open issue from co-author Brian Campbell, filed against -00, argues against that requirement. Neither document yet settles what an auditor can demand.

A Question for Auditors

Our editorial question, for one high-impact agent action: can the operator show, from records the agent could not alter, which agent acted, who delegated what authority at each hop, which deterministic policy decision allowed the action, what a human reviewer saw and approved, and what happened next? The tenets describe that target. They do not show that any deployment meets it.

See also NIST examines identity and authorization for AI agents, Audit an agent action, and October's four individual IETF drafts on agent records.