{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"authority":"guidance","category":"nist-ai-agent-identity"},"canonicalUrl":"https://controlsmap.com/frameworks/nist-ai-agent-identity/","description":"NIST NCCoE: Software and AI Agent Identity and Authorization","details":{"amendmentState":"Initial concept paper; comments closed 2026-04-02; project reviewing comments as of 2026-09-10","authority":"guidance","effectiveDate":null,"note":"Draft concept paper seeking input on a proposed NCCoE project. The seven selected topics below summarize questions and areas of exploration, not final requirements or a completed implementation guide. NIST-AGI identifiers are local catalog references, not NIST control numbers. The project focuses on enterprise agents; external agents from untrusted sources are outside its initial scope. The NIST AI Agent Standards Initiative, launched 2026-02-17, is a standards-development program rather than a certifiable standard: https://www.nist.gov/artificial-intelligence/ai-agent-standards-initiative","propositions":[{"id":"NIST-AGI-01","sourcePages":"Concept paper pp. 4, 6: Identification; Areas of Interest","title":"Distinct agent identities and identity boundaries"},{"id":"NIST-AGI-02","sourcePages":"Concept paper pp. 4, 7: Authentication; Relevant Standards and Guidelines","title":"Agent authentication and credential lifecycle"},{"id":"NIST-AGI-03","sourcePages":"Concept paper pp. 4, 6: Authorization; Areas of Interest","title":"Context-sensitive authorization and least privilege"},{"id":"NIST-AGI-04","sourcePages":"Concept paper pp. 4, 6: Authorization; Access Delegation","title":"Delegated authority and human accountability"},{"id":"NIST-AGI-05","sourcePages":"Concept paper pp. 4, 6: Auditing and non-repudiation; Logging and Transparency","title":"Verifiable agent action logs and authorization traceability"},{"id":"NIST-AGI-06","sourcePages":"Concept paper p. 4: Prompt Injection prevention and mitigation","title":"Prompt-injection prevention and limits on resulting harm"},{"id":"NIST-AGI-07","sourcePages":"Concept paper p. 6: Tracking Data Flows of an AI System","title":"Prompt provenance and data-flow tracking"}],"publicationDate":"2026-02-05","reviewed_at":"2026-09-10","source_url":"https://www.nccoe.nist.gov/sites/default/files/2026-02/accelerating-the-adoption-of-software-and-ai-agent-identity-and-authorization-concept-paper.pdf","version":"February 2026 draft concept paper"},"id":"std:nist-ai-agent-identity","mapUrl":"https://controlsmap.com/?v=1&node=std%3Anist-ai-agent-identity","sourceIds":["nist-ai-agent-identity"],"sourceUrl":"https://www.nccoe.nist.gov/sites/default/files/2026-02/accelerating-the-adoption-of-software-and-ai-agent-identity-and-authorization-concept-paper.pdf","title":"NIST Agent Identity (draft, Feb 2026)","type":"standard"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0ddade164badb762f67aff07dd69e64f6a995180b26f572da451591514483de1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nist-ai-agent-identity-nist-agi-03-0c271eec.json","sourceId":"ctrl:nist-ai-agent-identity:NIST-AGI-03","targetDetailPath":"/data/v1/records/std-nist-ai-agent-identity-5c357655.json","targetId":"std:nist-ai-agent-identity","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:105bb7026ff8c28fe9ac35d4811484cff434721aeb253a03b58e4e78c29c36ef","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nist-ai-agent-identity-nist-agi-04-70a3e945.json","sourceId":"ctrl:nist-ai-agent-identity:NIST-AGI-04","targetDetailPath":"/data/v1/records/std-nist-ai-agent-identity-5c357655.json","targetId":"std:nist-ai-agent-identity","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:55ed7986ac5a106d7ebee487bd81a7c08738b586c4efc471f2a3212e5fc88ed1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nist-ai-agent-identity-nist-agi-02-8f2c52e7.json","sourceId":"ctrl:nist-ai-agent-identity:NIST-AGI-02","targetDetailPath":"/data/v1/records/std-nist-ai-agent-identity-5c357655.json","targetId":"std:nist-ai-agent-identity","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7c2336bf6fcb3dc53cb4d7d994f37c005305e23ea0b735ddc93b6eb84b62549d","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nist-ai-agent-identity-nist-agi-06-e6b81ea1.json","sourceId":"ctrl:nist-ai-agent-identity:NIST-AGI-06","targetDetailPath":"/data/v1/records/std-nist-ai-agent-identity-5c357655.json","targetId":"std:nist-ai-agent-identity","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:91c93993e55fae8273f1d5748a58727626b7c856340977fa55f24a818def045c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nist-ai-agent-identity-nist-agi-01-b794d997.json","sourceId":"ctrl:nist-ai-agent-identity:NIST-AGI-01","targetDetailPath":"/data/v1/records/std-nist-ai-agent-identity-5c357655.json","targetId":"std:nist-ai-agent-identity","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:93ff6b6daac2b277c1b584759bee71a8dcfdba5ab7d9040d887d2bf97f2b54f4","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nist-ai-agent-identity-nist-agi-07-e4ca7bdd.json","sourceId":"ctrl:nist-ai-agent-identity:NIST-AGI-07","targetDetailPath":"/data/v1/records/std-nist-ai-agent-identity-5c357655.json","targetId":"std:nist-ai-agent-identity","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ffcbd308120f934280b7fb7846b7de181dba74f206cb87ca3455c58256514c46","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-nist-ai-agent-identity-nist-agi-05-1adf3e6a.json","sourceId":"ctrl:nist-ai-agent-identity:NIST-AGI-05","targetDetailPath":"/data/v1/records/std-nist-ai-agent-identity-5c357655.json","targetId":"std:nist-ai-agent-identity","type":"belongs_to"}],"schemaVersion":1}