NIST concept paper on software and AI agent identity and authorization
NIST's National Cybersecurity Center of Excellence published a concept paper on 5 February 2026 asking whether existing identity standards can carry AI agents. It proposes a laboratory demonstration applying identification and authorization controls to agents in enterprise settings, and it invited public comment until 2 April 2026. It is a proposal for a project, not a control an auditor can test.
The verdict
Verified
The document exists. The ledger fetched it at its publisher and quotes it.
Key facts
What the sources say
- Record ID
- AAL-2026-0001
- Kind
- Draft in progress
- Jurisdiction
- United States
- Last verified
- Added
- The paper is titled Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization.
- Its named authors are Harold Booth, William Fisher, Ryan Galluzzo and Joshua Roberts of NIST.
- NIST writes that AI agents are software systems that use data and algorithms to autonomously perform tasks.
- The paper asks for feedback on use cases, challenges, standards and technologies, and the comment window closed on 2 April 2026.
- Nothing in the paper is normative: it describes work NIST may do in its own labs with commercially available technology.
Dimension by dimension
2 dimensions, each one stated, silent or open
Identity, Authorization. Stated means the document you can open below says it; silent means the ledger read the document and it does not.
- IdentityStated
- The paper treats an agent as a distinct digital actor that needs its own identification, rather than borrowing a human user's identity.NIST Computer Security Resource Center, primary source, 5 February 2026.
- AuthorizationStated
- It proposes applying existing authorization controls to agents given access to data sets, tools and applications.NIST Computer Security Resource Center, primary source, 5 February 2026.
What it changes
For a team deploying an agent
Read this as the direction of travel, not a requirement. If you are deploying an agent inside a United States enterprise, the message is that the identity stack you already run is the stack NIST expects you to stretch over agents, so the practical work is naming each agent in your directory and scoping its authorization, not waiting for a new protocol to arrive.
Sources
What this record was verified against
- NIST Computer Security Resource CenterPrimary · 5 February 2026
Related
Records that sit beside this one
NIST AI Agent Standards Initiative
United States · verified 15 September 2026
NIST states it aims to catalyze an ecosystem where agents function securely on behalf of users and interoperate smoothly across the digital landscape.
NIST SP 800-63-4 Digital Identity Guidelines
United States · verified 15 September 2026
The guidelines apply to all online services for which some level of assurance in a digital identity is required, regardless of the constituency.
No binding United States federal law defines an AI agent's identity or authorization
United States · verified 15 September 2026
The federal work on agent identity sits in NIST's voluntary standards programme, not in statute.
Cite this record
Free to reuse under CC BY 4.0, with attribution. The record ID AAL-2026-0001 is permanent and is never reused.
- In a sentence
- According to the GAGE Agent Authority Ledger (as of 15 September 2026), nist concept paper on software and ai agent identity and authorization.
- APA
- GAGE (Global Academy of Generative-AI Education). (2026). NIST concept paper on software and AI agent identity and authorization. Agent Authority Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0001-nist-concept-paper-software-and-ai-agent-identity-and-authorization
- MLA
- "NIST concept paper on software and AI agent identity and authorization." Agent Authority Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0001-nist-concept-paper-software-and-ai-agent-identity-and-authorization.
- Chicago
- GAGE (Global Academy of Generative-AI Education). "NIST concept paper on software and AI agent identity and authorization." Agent Authority Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0001-nist-concept-paper-software-and-ai-agent-identity-and-authorization.
- Permalink
- https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0001-nist-concept-paper-software-and-ai-agent-identity-and-authorization
Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any NIST, IETF or MCP publication.
Back to the full ledger, or every record for United States and every draft in progress record.
GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.