No binding United States federal law defines an AI agent's identity or authorization
There is no United States federal statute that says what an AI agent's identity is, who may authorise one, or what it may be permitted to do. The federal activity is at the standards stage: a NIST concept paper, a request for information and an initiative page, none of which bind anyone. Bills have been introduced and none has become law.
The verdict
Absent
The ledger searched and found no instrument. The record says where it looked and when.
Where the ledger looked: Checked on 15 September 2026. Searched the NIST AI Agent Standards Initiative page and the NCCoE concept paper on software and AI agent identity and authorization, both of which describe proposed voluntary work rather than a rule. Searched for federal statutes and introduced bills defining AI agent identity, delegation or authorization; the results name introduced legislation that would direct NIST to develop standards, and none that has been enacted. The federal identity baseline, NIST SP 800-63-4, states in terms that person refers only to natural persons and excludes machine to machine authentication from its scope.
Key facts
What the sources say
- Record ID
- AAL-2026-0028
- Kind
- Binding law
- Jurisdiction
- United States
- Last verified
- Added
- The federal work on agent identity sits in NIST's voluntary standards programme, not in statute.
- The NCCoE concept paper of 5 February 2026 proposes a demonstration project and invited comment; it creates no obligation.
- NIST SP 800-63-4, the federal digital identity baseline, applies to natural persons and excludes machine to machine authentication.
- Sector regulators apply existing law to AI use, but no federal instrument defines the identity or authority of an agent as such.
Dimension by dimension
2 dimensions, each one stated, silent or open
Identity, Authorization. Stated means the document you can open below says it; silent means the ledger read the document and it does not.
- IdentitySilent
- No federal definition of an agent's identity exists, so an organisation's own directory naming is the only record that an agent is a distinct actor.NIST AI Agent Standards Initiative, primary source, 14 August 2026.
- AuthorizationSilent
- No federal rule states who may grant an agent authority or what the grant must contain.NIST Computer Security Resource Center, concept paper, primary source, 5 February 2026.
What it changes
For a team deploying an agent
Do not wait for a rule. In the United States the only authority record your agent has is the one you write, so the practical move is to adopt the dimensions NIST is collecting evidence on and keep your own register of every agent, its principal, its permissions and who can switch it off.
Sources
What this record was verified against
- NIST AI Agent Standards InitiativePrimary · 14 August 2026
- NIST Computer Security Resource Center, concept paperPrimary · 5 February 2026
- NIST SP 800-63-4Primary · 26 August 2025
Related
Records that sit beside this one
NIST concept paper on software and AI agent identity and authorization
United States · verified 15 September 2026
The paper is titled Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization.
NIST AI Agent Standards Initiative
United States · verified 15 September 2026
NIST states it aims to catalyze an ecosystem where agents function securely on behalf of users and interoperate smoothly across the digital landscape.
NIST SP 800-63-4 Digital Identity Guidelines
United States · verified 15 September 2026
The guidelines apply to all online services for which some level of assurance in a digital identity is required, regardless of the constituency.
Cite this record
Free to reuse under CC BY 4.0, with attribution. The record ID AAL-2026-0028 is permanent and is never reused.
- In a sentence
- According to the GAGE Agent Authority Ledger (as of 15 September 2026), no binding united states federal law defines an ai agent's identity or authorization.
- APA
- GAGE (Global Academy of Generative-AI Education). (2026). No binding United States federal law defines an AI agent's identity or authorization. Agent Authority Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0028-no-us-federal-law-defines-agent-identity-or-authorization
- MLA
- "No binding United States federal law defines an AI agent's identity or authorization." Agent Authority Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0028-no-us-federal-law-defines-agent-identity-or-authorization.
- Chicago
- GAGE (Global Academy of Generative-AI Education). "No binding United States federal law defines an AI agent's identity or authorization." Agent Authority Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0028-no-us-federal-law-defines-agent-identity-or-authorization.
- Permalink
- https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0028-no-us-federal-law-defines-agent-identity-or-authorization
Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any NIST, IETF or MCP publication.
Back to the full ledger, or every record for United States and every binding law record.
GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.