The National Institute of Standards and Technology’s National Cybersecurity Center of Excellence is seeking public input on a new concept paper focused on how identity standards and access control practices should apply to software and artificial intelligence agents.
NIST’s National Cybersecurity Center of Excellence said Thursday the concept paper, titled “Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization,” outlines a potential NCCoE project aimed at demonstrating how organizations can securely identify and authorize AI agents used to automate tasks across systems and data environments. Public comments will be accepted through April 2.
The Potomac Officers Club’s 2026 Artificial Intelligence Summit on March 18 convenes government and industry practitioners to explore how AI, machine learning and automation are reshaping federal operations. Discussions will focus on real-world implementation, mission-driven use cases and the challenges of deploying AI at scale across complex, security-focused environments. Register now.
Why Is NIST Looking at Identity and Authorization for AI Agents?
NIST said AI agents can autonomously perform tasks using data, algorithms and access to enterprise tools, creating opportunities for improved productivity and decision-making. However, the agency warned that expanding agent access to datasets and applications introduces risks that require stronger identification and authorization controls.
The concept paper emphasizes that organizations will need to apply identity standards and best practices to mitigate threats tied to AI agents operating with broad system privileges.
What Would the NCCoE Project Cover?
NIST said the potential project would focus on applying existing identity and access management standards to agentic architectures that use tools and context dynamically to take actions.
The agency noted the effort would not address all AI system architectures. The concept paper states that retrieval-augmented generation and large-language-model-only implementations are out of scope.
NIST said it is seeking input on use cases, technical challenges and existing standards that could guide secure agent identity and access management. Other areas of interest include AI agent auditing, non-repudiation and controls to mitigate prompt injection attacks.
What Standards Could Shape AI Agent Identity Controls?
The concept paper highlights multiple existing standards and frameworks that could inform the project, including OAuth, OpenID Connect, System for Cross-domain Identity Management, Secure Production Identity Framework for Everyone and SPIFFE Runtime Environment, and Next Generation Access Control.
NIST cited existing guidance, such as Special Publication 800-207, Zero Trust Architecture, and SP 800-63-4, Digital Identity Guidelines, as potential reference points.
