What happened
On 27 Oct 2026 NIST's Cybersecurity Insights published blog #2 of its agentic identity/authentication/authorization series, proposing an initial set of ten design tenets for IAM systems that manage agents across enterprise and consumer-facing use cases. Each tenet is stated with a description of what meeting it means and the primary risks it mitigates: unique agent identity with a distinct identity/credential/access-management lifecycle; agent linking, delegation and scope attenuation; least and zero standing privilege; short-lived, dynamic and revocable Just-In-Time authorization with runtime verification; human-in-the-loop triggers with consent-fatigue awareness; cryptographically signed mandates and constraints; plus further tenets (auditable execution, secrets hygiene, etc.).
Why it matters
This is authoritative NIST guidance framing the IAM requirements for agentic AI. It gives practitioners a concrete reference model for cryptographically verifiable agent identity, delegated-authority attenuation, zero-standing-privilege and revocable JIT authorization, and it complements NIST NCCoE's 'Software and Agentic AI Identity and Authorization' demonstration project. It is a design-tenet framework rather than a normative publication, so it sets direction for the NIST agent-identity standards program.
Action needed
Review the ten tenets and map them against your agentic IAM architecture; use them to shape agent identity/credential lifecycle, scoped delegation and runtime authorization decisions, and watch for the NIST NCCoE demonstration-project outputs.