On October 27, 2026, the National Institute of Standards and Technology (NIST) published Design Tenets for Agent Identity Management Systems. The publication outlines 10 security design tenets for managing AI agent operation permissions. Organizations are advised to apply these tenets based on their specific operating environments and risk levels.
1. Distinct Agent Identification
Agentic infrastructure should enable unique, cryptographically verifiable identification for agents. This ensures agent identities remain clearly distinguishable from human users or service accounts.
2. Agent Linking, Delegation & Attenuation
Agents should be cryptographically linked to the entities initiating their tasks throughout execution. As authority is delegated to sub-agents or downstream services, access scopes must attenuate. Downstream entities must never claim broader authority than their parent entities.
3. Least & Zero Standing Privilege
Agents must operate with zero standing privilege and hold no persistent rights while idle. Access must be strictly bounded to the minimum scope required for a designated task. In addition, separation of duties must prevent agents from assuming conflicting privileges.
4. Short-Lived, Dynamic & Revocable Authorization
Every tool call or resource access must undergo continuous runtime verification based on current risk states. Systems should avoid static or long-lived keys to prevent persistent unauthorized access from credential compromise. Security systems can immediately contain or revoke an agent's authority upon detecting anomalous behavior.
5. Human-in-the-Loop Triggers
Organizations must define risk thresholds and tolerances. When agent behavior reaches these thresholds, human review of agentic actions is triggered. Escalation flows must provide adequate contextual information for human evaluation.
6. Mandates and Constraints
Task originators should create cryptographically signed mandate statements. These statements define intended outcomes and explicit constraints for agentic actions.
7. Architectural Separation of Policy from Reasoning
The reasoning engine must be architecturally separated from policy enforcement systems. This ensures that prompt injections or untrusted data cannot tamper with credentials or expand an agent's actual permissions.
8. Deterministic Access Decisions
Deterministic capabilities should serve as the primary mechanism for making access decisions. Probabilistic information may be used as input, but it must not be the primary basis for authorization. This approach maintains control over agent behavior while delivering consistent, predictable security controls.
9. Continuous Monitoring
Monitoring systems should be built upon agent-specific metrics, thresholds, and policies. They must monitor access behavior in real time and issue warnings when anomalies occur.
10. Immutable Evidence
Enterprises must maintain an unbroken, tamper-evident chain of custody detailing agent identities, delegated intents, and execution outcomes. This logging infrastructure provides a complete chain of trust for incident investigation and behavioral analysis. It also prevents a compromised agent from tampering with or deleting its own activity logs.