NIST treats AI agents as separate digital identities with their own access rules

The NIST National Cybersecurity Center of Excellence published a concept paper on 5 February 2026 that explicitly treats AI agents as non-human identities with four requirements of their own: identification, authorisation, delegation and logging. In concrete terms, this means you no longer manage an AI agent as a feature of a product, but as an independent principal with its own identity, task-bound rights and an audit trail. NIST proposes applying existing standards such as OAuth 2.0, OpenID Connect and SPIFFE/SPIRE to agents.

Microsoft developed the same line in July 2026 with least-privilege guidance: each agent gets its own principal, scoped permissions, a controlled tools manifest and end-to-end audit logs. For organisations working with sensitive information, this means the IAM architecture needs agent-specific layers: workload identities, delegation chains and agent telemetry that make later reconstruction and attribution possible.

What exactly does the NIST concept paper say about AI agent identity?

The concept paper “Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization” characterises AI agents as a new class of software and AI agent identities that must be distinguished from human users. NIST opened a public comment period that ran until 2 April 2026.

According to the accompanying AI Agent Standards Initiative page, the paper is part of a broader standards agenda, and the NCCoE is preparing a demonstration project to show how identity standards can be applied to enterprise agents. In our assessment, the core of this is that agent identity is no longer a standalone experiment, but is being embedded in a federal standardisation path that leans on existing building blocks rather than on new, isolated protocols.

Which four functions must identity and access management for AI agents cover?

The Cloud Security Alliance set out in a research note of 30 March 2026 how the NIST framework defines four functional domains. Translated into concrete design questions:

• Identification: register agents as non-human identities with workload attestation (for example via SPIFFE/SVID) and metadata about autonomy level and permitted tasks.
• Authorisation: use OAuth 2.0 extensions, OpenID Connect and policy-based access control (ABAC) to determine rights per agent, per tool and per resource. According to the CSA note, static role models fall short for dynamic agent authorisation.
• Delegation: use dual-identity tokens to make visible who is ultimately responsible, with the human as the subject and the agent as the acting party, so that the delegation chain remains traceable.
• Logging and transparency: link every tool call and every resource action to an agent identity and the delegating human, suitable for forensics and audits.

Together these four functions form a verifiable basis. Anyone with gaps here cannot reconstruct afterwards which agent acted under which authority. That makes the separation of duties in autonomous AI processes a design question, not an afterthought.

How does Microsoft operationalise least privilege for AI agents?

In the guidance “Least privilege for AI agents: Identity, access, and tool binding” of 16 July 2026, Microsoft describes that every agent must be treated as a first-class principal. According to Microsoft, this means: its own lifecycle identity, explicit role assignment, strictly scoped permissions, controlled tool access and end-to-end auditability.

The goal Microsoft sets out is to be able to answer questions such as: what happened, under whose authority, and what changed? That connects directly to the four NIST functions. We read these two developments as convergence: a large vendor is already building agent IAM into its product architecture, while a standardisation institute formalises the framework. This shift from policy to enforceable control is also central to our analysis of Microsoft's shift towards runtime enforcement.

Why do machine identities put pressure on the existing IAM stack?

An IAM analysis by Spiceworks on 5 August 2026 argues that machine identities now outnumber humans. The piece advocates treating agents as non-human identities with explicit ownership, scoped privileges, continuous monitoring and revocation paths.

The practical consequence is a question of scale. Where user IAM revolves around manageable numbers of employees, agents involve potentially thousands of identities with varying tasks and lifespans. Without inventory, ownership and revocation, a blind spot arises. This connects to the broader discussion about the governance of agentic AI and AI agents and to the question of how to go about separating what agents can do from what they may do.

What does this mean for the verification of AI workflows in practice?

The common thread in the sources is that attributability is the problem: being able to show which agent, under which identity and delegation, performed which action. For professionals working with confidential information, these are the control points per workflow:

1. which AI agents exist and under which workload identity they run;
2. on behalf of which human or system they act, in other words the delegation chain;
3. which rights, tools and data paths they have;
4. which agent logs and audit trails are available for reconstruction and accountability.

A verification layer such as IamVera.ai can act here as a viewing layer on top of this agent IAM architecture: not a replacement for NIST standards or Microsoft controls, but a console in which verification steps, corrections, disagreements between models and sources become visible for inspection. Vera can route a task through selected independent models and expose those steps, which supports control; it is not a guarantee that every autonomous action can be reconstructed or stayed within a bounded task. The Semantic Privacy Shield is designed to replace sensitive document values before AI processing on EU infrastructure with synthetic, session-only equivalents, with a fail-closed workflow: if the privacy verification fails, the document is not sent onward. The professional final judgement remains with the user. More about how verification relates to evidence can be found in our hub on AI verification.

Sources: The article draws on the NIST NCCoE concept paper and the AI Agent Standards Initiative, on Microsoft's least-privilege guidance, and on analyses from the Cloud Security Alliance and Spiceworks.

← All articles in this topic ← All articles