NIST's latest agent identity guidance turns a common prototype shortcut into a design warning: an agent should not borrow a person's credentials and appear in the audit trail as that person.

What NIST Published

On August 27, 2026, the National Institute of Standards and Technology published guidance on identity and authorization for software and AI agents. It draws on public comments submitted to an NCCoE concept paper and identifies four recurring failures: credential sharing, static or long-lived credentials, broadly scoped access, and excessive reliance on human approval prompts.

The post is guidance, not a new binding standard. NIST says the work will inform its Software and AI Agent Identity and Authorization project, which plans further resources and publications.

Give The Agent Its Own Identity

NIST recommends treating agents as first-class entities with unique identifiers, credentials, and entitlements tied to the user or system that operates them. That keeps the audit record honest: the system can distinguish the agent that acted, the principal that delegated authority, and the permissions used for the transaction.

Existing standards provide a starting point. The guidance names OAuth 2.0 and SPIFFE, along with emerging work such as WIMSE and the Identity Assertion JWT Authorization Grant. It also points to sender-constrained methods such as DPoP for reducing token theft. NIST does not claim that one protocol now solves every consumer or cross-organization agent identity problem.

Match Credentials To The Agent's Lifetime

A short-lived agent should receive short-lived authority. NIST calls for dynamic, tightly scoped, audience-restricted credentials instead of API keys copied into config files, markdown, or logs. An agent that only needs to create a draft should not inherit a token that can publish, delete, or administer the underlying system.

This also changes revocation. The operator needs to disable the agent's identity or grant without disabling the human account behind it. Shared credentials make that distinction impossible and weaken non-repudiation in financial, health, and other sensitive workflows.

Human Approval Can Become A Failure Mode

NIST compares repeated agent approval requests with MFA fatigue. If a workflow interrupts the operator for every small permission change, the operator learns to click allow. The approval step then records consent without providing much judgment.

Approval should sit at consequential boundaries and include the action, target, data, and authority being requested. Sensitive credentials should not be collected through an agent prompt. NIST points to the Model Context Protocol's warning against using elicitation for sensitive information.

A Practical Identity Check

Before an agent can take an external or destructive action, the system should answer:

  • Which agent is acting, and who or what delegated its authority?
  • Is the credential short-lived, audience-restricted, and scoped to this action?
  • Will the audit log identify the agent rather than impersonate the human principal?
  • Can the grant be revoked without disabling the person or service behind it?
  • Does the approval screen contain enough context for a real decision?

If the system cannot answer those questions, adding more agent autonomy will make the identity gap more expensive to unwind.

Related: Read our overview of the NIST AI Agent Standards Initiative and our field notes on agent identity, delegation, and revocation.