The National Institute of Standards and Technology (NIST) has outlined 10 design tenets for agent identity management systems, calling for distinct identities, tightly scoped permissions, continuous monitoring and stronger accountability as organizations expand the use of AI agents. The guidance addresses identity, authentication and authorization across enterprise and consumer-facing applications. It recommends cryptographically verifiable identities for AI agents, access limited to the minimum privileges needed for specific tasks, short-lived and revocable authorization, and human review when actions exceed defined risk thresholds. The tenets are intended to help organizations manage the risks associated with agents operating on behalf of individuals and organizations.
“As a starting point, we have proposed an initial set of ten design tenets, with a focus on defining a vision for IAM systems that seek to manage agents across both enterprise and consumer-facing use cases,” Harold Booth, Bill Fisher, Ryan Galluzzo and Tom Clancy, NIST researchers, wrote in a Tuesday blog post. “Each tenet has a description of the core of what it means to meet that tenet, along with the primary risks that tenet mitigates. Tenets should be applied and implemented by organizations based on the risk associated with the agentic transactions they intend to support, the environment in which they operate, and the data, tools, and skills they interact with.”
NIST also calls for separating the systems that determine what an AI agent attempts to do from those that control what it is permitted to access, warning that guardrails alone are insufficient to address prompt injection and privilege escalation risks. The proposed principles include deterministic access decisions, cryptographically signed mandates that define task boundaries, continuous monitoring for anomalous behavior and tamper-evident logging maintained independently of agents.
Furthermore, the agency noted that multiple tenets may be needed to mitigate individual threats and acknowledged that current standards and technologies may not yet support all the proposed principles across different deployment models. The guidance will inform demonstrations by NIST’s National Cybersecurity Center of Excellence exploring how standards and technologies can support agent identity and authorization.
The document sets out ten principles for securing agentic infrastructure, beginning with how agents are identified and linked to the people behind them. Agents should have unique, cryptographically verifiable identities, distinguishable from human users and service accounts and ideally tied to a specific workload, environment and approved configuration. Their identity, credential and access management lifecycle should also be separate from that of human principals.
The document said this prevents agents from impersonating users or service accounts and allows autonomous actions to be traced back to the specific software component. Agents operate on behalf of individuals or organizations, so they and the entities that initiate their tasks should be cryptographically linked throughout execution to maintain a clear chain of trust.
Consumer-facing implementations should support anonymous or pseudonymous transactions where privacy-preserving technology is available. As authority is delegated to sub-agents or downstream services, scopes should attenuate so that downstream entities can never claim more authority than the parent. The document said this supports non-repudiation, auditability and accountability, and that without it high-impact transactions could not be attributed to the responsible party.
On access, the document said agents should operate with zero standing privilege, holding no persistent rights when idle. Access should be limited to the minimum scope a task requires and constrained by separation of duties, so an agent cannot assume conflicting privileges that bypass governance controls. It warned that an agent with standing or broad privileges could take unintended actions or be hijacked to reach sensitive data or conduct high-impact transactions.
All access grants should be just-in-time, time-bounded and audience-specific, and each tool invocation, API call or resource access should undergo continuous runtime verification based on current state, environmental context and risk profile. That allows security systems to contain or revoke an agent’s authority if they detect anomalous behavior or context drift. Systems should avoid long-lived bearer tokens and static, reusable secrets, and agents should acquire ephemeral access only when a task begins. The document said stolen or exposed long-lived credentials give attackers persistent access, and that a hijacked agent holding a valid token could not otherwise be interrupted mid-task.
The document also calls for human oversight and clear statements of intent. Every organization should define risk thresholds and tolerances that trigger human review of agentic actions. Technology components should escalate to the correct authority with enough information for the reviewer, which may include context beyond the triggering conditions. Escalation flows should also account for consent fatigue, where escalations become so frequent that humans approve agentic actions out of habit rather than after weighing the risk. Without such triggers, the document said, a malfunctioning, hallucinating or manipulated agent could cause irreversible damage.
A task originator, whether a human, another agent, a service account or an organization, can create cryptographically signed mandates that define the intended outcomes and constraints for agentic actions. These can be generated when the agent is tasked, built into enterprise configurations or drawn from organizational templates. In consumer-facing scenarios, they should avoid unnecessarily disclosing sensitive user information. Downstream applications and services can verify the signatures and use the mandates to support authorization decisions, auditing, non-repudiation and accountability.
Two principles address how access decisions are made. The logic that determines what an agent attempts to do should be architecturally separated from the systems that determine what it is allowed to do, so prompt injections or untrusted data processed by the reasoning engine cannot manipulate credentials or expand permissions.
The document noted that large language models take data and instructions as a single stream of tokens through one interface, which leaves no built-in separation between data and control. It said that separation must be enforced through architecture and that guardrails alone are insufficient. Organizations should also rely on deterministic capabilities as the primary mechanism for access decisions in agentic scenarios. Probabilistic information can inform those decisions but should not be the primary basis. The document said this limits the impact of attacks such as prompt injection and makes agent behavior more consistent and predictable when accessing sensitive services, data and tools.
The final two principles cover monitoring and evidence. Agents operate at a scale and velocity beyond what humans and most deterministic automation can match, so systems should monitor agentic access and warn of potentially anomalous behavior. They should use agent-specific metrics, thresholds and policies to manage the volume of interactions. The document said failing to respond to changes in the risk posture of an agent or its environment can lead to undetected compromise, configuration drift or privilege escalation, and that the risk grows with long-running agents or those that act across many tools.
Finally, the enterprise should maintain an unbroken, tamper-evident chain of custody and an append-only body of evidence detailing the agent’s identity, delegated intent and resulting actions. This logging infrastructure should be independent of the agent, because a compromised agent that could modify its own logs might delete or change a record of its actions. The document said independent, append-only logging gives forensic teams a trustworthy chain of custody for incident response and drift analysis.
“While each design tenet is mapped to a set of associated risks, it is important to remember that multiple tenets may need to be in place to effectively mitigate a specific attack, threat, or risk,” the researchers said. “For example, the design tenet of Linking and Delegating agentic tasks is important in mitigating ‘confused deputy’ attacks – where a prompt injection is used to convince an agent with broadly scoped access to execute an action they otherwise would not.”
They added that effective prevention of a ‘confused deputy’ attack also requires application of additional tenets, such as Least Privilege (to limit the scope of agentic actions), Architectural Separation of Policy from Reasoning (to minimize prompt injections), and Deterministic Access Decisions (to strictly enforce scope). The end result of building upon these design tenets is a holistic set of protections and capabilities that maximizes effectiveness and minimizes risks of agentic services.
