NIST proposed ten initial design tenets for agent identity and access management (IAM) on 27 October 2026. Its Cybersecurity Insights post says the proposals draw on public comments and stakeholder engagement and will guide agent demonstrations at the National Cybersecurity Center of Excellence (NCCoE). Organizations should apply them according to transaction risk, deployment environment and the data, tools and skills involved.[1]
The proposals call for distinct, cryptographically verifiable agent identities, ideally tied to a specific workload, environment and approved configuration. Delegation should preserve a cryptographic link to the initiating entity, with authority narrowing downstream. Other tenets call for zero standing privilege, short-lived and revocable authorization, human review triggers, signed mandates describing intended outcomes and constraints, and continuous monitoring.[1]
Two tenets address enforcement directly: separate policy enforcement from agent reasoning, and use deterministic mechanisms as the primary basis for access decisions. NIST argues that guardrails alone are insufficient. Its evidence tenet calls for independent, append-only logging of agent identity, delegated intent and resulting actions, with a tamper-evident chain of custody.[1]
NIST cautions that mitigating an attack can require several tenets together and that current standards and technology cannot immediately fulfill every tenet across deployment models. This is a proposed design direction; the post does not report a product release or recommend a fixed software version.[1]
[1]: NIST, “Design Tenets for Agent Identity Management Systems,” 27 October 2026. https://www.nist.gov/blogs/cybersecurity-insights/design-tenets-agent-identity-management-systems
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
1c4768703d900385cb49c6eb41d5ccf53278001b75b830778b5a1bae7c35765f
