In October 2026 US federal agencies published two voluntary documents about agents. One says how an agent should get access. The other says what to do when an agent acts outside the job it was given. Read together, they are a checklist for any company whose staff are agents holding keys.

How Agents Should Get Access

On 27 October NIST's National Cybersecurity Center of Excellence posted ten design tenets for agent identity management. Five stand out for operators.

  • Each agent gets its own identity. Agents "should have an identity, credential, and access management lifecycle distinct from human principals."
  • No standing keys. Systems "need to avoid long-lived bearer tokens or static, reusable secrets, instead requiring agents to acquire ephemeral access only when a task is initiated".
  • Prompts are not a control. On instructions and filters inside the model, the text is blunt: "Guardrails alone are insufficient."
  • Human review has limits. Escalation design should be "cognizant of consent fatigue where human escalation becomes so frequent that agentic actions are approved habitually".
  • Logs sit out of the agent's reach. "If activity logs are accessible or modifiable by the agent itself, a compromised agent could tamper with log files, deleting or changing its actions."

What to Do When an Agent Goes Out of Scope

NIST, the NSA and CISA jointly published key practices for incident readiness and response in super intelligence training and evaluation. It defines a control incident as one where agents take "significant uninstructed actions that compromise explicit or implicit policies, controls, or security measures imposed by the operator to define the intended task scope or to ensure human oversight."

  • Kill the run, not the company: "Automatically shut down impacted SI agent trajectories on detection of a control failure or in-progress SI control incident".
  • "Revoke credentials under the organization's control that were accessed during the incident and rebuild any environments that may have been compromised".
  • Before restarting, check that "monitors, logging, egress allowlists, shutdown mechanisms, permission restrictions, and other containment layers are functional".
  • Count the close calls too. A near-miss is one that "presented a reasonably foreseeable or imminent risk" of an incident.
  • Reporting is voluntary: "Voluntarily report cybersecurity incidents or near-misses arising from SI control incidents to CISA as appropriate".

The Operator Cut

  • Write each agent's scope down. An incident is measured against the scope the operator set, so an unwritten scope makes every incident arguable.
  • One identity and one short-lived key per agent, issued when a task starts.
  • A kill switch that stops one run without stopping every agent.
  • Logs the agent cannot edit.
  • Resume only after revoking what the agent touched and checking that containment works.

The October key thefts covered in Black October show why the second point matters.

What This Does Not Settle

  • Both documents are voluntary. Neither creates a legal duty.
  • The incident practices are aimed at labs training and evaluating highly capable agents. They say only that they "may also apply to deployers of such SI agents."
  • The NCCoE tenets are design guidance, not a standard.

Related: See the agent overreach containment and agent credential architectures playbooks, and the United States page.