Agent IAM Self-Check Against NIST’s Ten Design Tenets
Score your agent stack on identity, delegation, standing privilege, policy separation and evidence before you scale it
Operator checklist built on the ten design tenets for agent identity, authentication and authorization that NIST’s National Cybersecurity Center of Excellence (NCCoE) published on 27 Oct 2026. NIST calls them "an initial set of ten design tenets" drawn from public comments on its agent identity and authorization project, and says they "should be applied and implemented by organizations based on the risk associated with the agentic transactions they intend to support". They are voluntary and not a standard. NIST also notes that not every tenet will be achievable right away. Use them to find gaps and plan a roadmap, not as a pass mark. The recipe groups the ten into five passes an agent company can run in an afternoon: who the agent is and who it acts for; what it holds and for how long; when a person is pulled in; where the allow decision is made; and what record survives if the agent goes wrong. For who the agent is on a network, see /playbooks/agent-identity-kya/; for how its credentials are issued and scoped, see /playbooks/agent-credential-architectures/.
Core Workflows (5)
Each workflow represents a critical business function. Click any workflow to see detailed automation architecture.
Give each agent its own identity and a traceable principal (tenets 1–2)
Led by: OwnerCheck that every agent has an identity of its own, "distinguishable from other identities (e.g., human users, service accounts)", with its own credential lifecycle, rather than running on a person’s login or a shared service account. Check that each task links the agent to the person or organization that started it, and that authority narrows as it is passed down: "downstream entities can never claim more authority than the parent." A subagent or downstream service that can do more than its parent fails this pass.
Remove standing privilege and long-lived tokens (tenets 3–4)
Led by: OwnerList every credential each agent can reach while idle. NIST’s target is that agents "operate with zero standing privilege, holding no persistent rights when idle", with grants that are just-in-time, time-bounded and audience-specific. Flag every static API key, long-lived bearer token or shared secret in env vars or config files, and replace it with a credential minted when the task starts and revocable mid-task. Check that no single agent holds two duties that should be separated, such as raising and approving a payment.
Set human-review triggers and signed mandates (tenets 5–6)
Led by: OwnerWrite down the risk thresholds that send an agent action to a person, and check that the escalation carries enough context to decide. Watch the rate: NIST warns about "consent fatigue where human escalation becomes so frequent that agentic actions are approved habitually". Where tasks cross systems, have the task originator issue a signed mandate stating the intended outcome and constraints, which downstream services can verify and use in their own allow decision.
Keep the allow decision outside the model (tenets 7–8)
Led by: OwnerCheck that what the agent tries to do and what it is allowed to do are decided by different systems, so injected text cannot widen permissions. NIST is blunt: "Guardrails alone are insufficient." Access decisions should be deterministic, with model output used at most as one risk signal and never as the primary mechanism. A rule written only in the prompt, such as telling the agent never to email outside the company, with no matching gate in the tool or gateway fails this pass.
Monitor agent-specific signals and keep evidence the agent cannot edit (tenets 9–10)
Led by: OwnerSet agent-specific metrics and thresholds for anomalous access, since agents act at a rate people cannot review by hand. Keep an append-only record of the agent’s identity, the delegated intent and the resulting actions, on infrastructure "independent of the agent to prevent modification". If the agent can write to, rotate or delete its own logs, it fails this pass.