News · By Alex Rivera (pen name) · 2 November 2026

NIST AI Agent Standards Initiative: What Exists in 2026

As of 1 November 2026, NIST has not published an AI agent standard. The NIST AI Agent Standards Initiative page still lists only a request for information, a concept paper and listening sessions. NIST's newest agent item is a 27 October blog post, "Design Tenets for Agent Identity Management Systems", which sets out ten identity tenets for agents.

In our assessment, that post is the most practical thing NIST has produced on agents this year. This news piece sets out what each NIST item is, what it is not, and what security leaders should do now. All sources were checked on 1 November 2026.

A note on names. Under Executive Order 14434 of 29 September 2026, agencies shall, "to the maximum extent permitted by law," use "Super Intelligence" and "SI" in place of "Artificial Intelligence" and "AI" in public communications, so newer NIST pages say "super intelligence (SI)" and "SI agents". NIST's AI center is now the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) (formerly CAISI), and on 20 October the SP 800-53 control overlays project became COSIS (formerly COSAiS). The order says it does not require altering previously issued documents, so older pages keep the old names. We quote each source with the name it uses.

NIST AI agent identity: the ten design tenets (27 October 2026)

The post, "Design Tenets for Agent Identity Management Systems", appeared on NIST's Cybersecurity Insights blog, dated 27 October 2026, by three NIST authors and one from MITRE, and is linked from the hub of NIST's National Cybersecurity Center of Excellence (NCCoE) agent identity project. The authors write that "we have proposed an initial set of ten design tenets". It is a blog post, not a formal NIST publication: it is not a Special Publication, not a standard, and it states no comment period. Our AI agent identity analysis measures Entra Agent ID, OAuth token exchange and SPIFFE against these tenets. The tenets are:

Distinct Agent Identification
Agent Linking, Delegation & Attenuation
Least & Zero Standing Privilege
Short-Lived, Dynamic & Revocable Authorization
Human-in-the-Loop Triggers
Mandates and Constraints
Architectural Separation of Policy from Reasoning
Deterministic Access Decisions
Continuous Monitoring
Immutable Evidence

Several are concrete enough to use as review criteria today:

Distinct identity. "Agents should have an identity, credential, and access management lifecycle distinct from human principals." See agent identity and non-human identity.
Attenuating delegation. As authority passes to sub-agents, "scopes attenuate so that downstream entities can never claim more authority than the parent." This helps mitigate "confused deputy" attacks, "where a prompt injection is used to convince an agent with broadly scoped access to execute an action they otherwise would not."
Zero standing privilege. "Agents operate with zero standing privilege, holding no persistent rights when idle." The same tenet also requires least privilege.
Short-lived, audience-specific access. "All access grants are Just-In-Time (JIT), time-bounded and audience-specific." The post adds that systems "need to avoid long-lived bearer tokens or static, reusable secrets".
Sustainable approvals. Escalation must be "cognizant of consent fatigue". See human-in-the-loop.
Policy outside the model. "The logic that determines what an agent attempts to do is architecturally separated from the systems that determine what it is allowed to do." The rationale is blunt: "Guardrails alone are insufficient." Tenet 08 adds that probabilistic signals may inform an access decision but are "not used as the primary mechanism for making access determinations."
Agent-proof logs. "This logging infrastructure is independent of the agent to prevent modification".

NIST is candid about the limits: "not all of these design tenets will be immediately fulfilled by the current state of standards and technology". It also says the tenets "will be the guideposts for our agentic demonstrations in the NCCoE". Our assessment: tenets 07 and 08 restate, from a standards body, the point of our piece on whether prompt injection can be prevented: control has to sit outside the model, because filters and guardrails alone do not stop prompt injection.

Timeline: NIST's 2026 AI agent work

Three tracks run in parallel: CAISSI security research, the NCCoE identity project and the COSIS control overlays. Dates are as printed on each source.

8 and 12 January 2026: call for comments on agent security (the NIST agent RFI). A Federal Register notice (8 January) and a NIST announcement (12 January) opened a request for information under docket NIST-2025-0035. The notice warns agent systems "may be susceptible to hijacking, backdoor attacks, and other exploits." Comments closed on 9 March. According to FederalRegister.gov's added Regulations.gov content, which it says is not part of the official document, 937 comments were received.
5 February 2026: NCCoE concept paper. "Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization" asked for comments by 2 April on applying identity standards to agents.
17 February 2026: launch. NIST announced the AI Agent Standards Initiative, with three pillars: industry-led standards, open source protocols, and research on "AI agent security and identity". It promised that "In the months ahead, NIST will announce research, guidelines, and further deliverables".
23 March 2026: red-teaming results. A NIST research blog post summarized a paper CAISI published with Gray Swan, the UK AI Security Institute and several frontier AI labs, analyzing a public red-teaming competition hosted by Gray Swan. According to NIST's summary, "Across more than 250,000 attack attempts from over 400 participants, at least one successful attack was found against all of the target frontier models".
18 May 2026: summary of RFI responses. NIST's summary of RFI responses (report 800-5). Its abstract says "Commenters widely agreed that AI agents present novel security threats and that these security concerns present a barrier to adoption." It adds that commenters broadly agreed fundamental cybersecurity principles and practices "will require adaptation to satisfactorily address agent security." The full PDF returned 404 when we checked, so we cite only the abstract.
29 September 2026: summary of concept paper comments. The NCCoE reported feedback "from more than 600 commenters" and chose its DevSecOps project as the first implementation use case. The summary of comments says "Almost everyone expressed the need for agents to have distinct, verifiable non-human identities", but "there was no consensus on the exact means for doing this".
16 October 2026: incident practices with NSA and CISA. NIST CAISSI, the NSA's Super Intelligence Security Center and CISA released ten voluntary practices for handling incidents in SI training and evaluation. The voluntary document is "primarily intended for organizations training or evaluating highly capable SI agents on long-horizon tasks with limited human supervision." It treats actions caused by prompt injection as "instructed actions", so they fall outside its definition of an SI control incident; the design tenets address it directly. Practice 1.5 says to "Route any required network access through a monitored gateway", the pattern in our egress proxy guide.
27 October 2026: the ten design tenets, covered above.

What is still missing

A standard. Nothing above is a standard or a requirement. The initiative page describes NIST's role as producing "voluntary guidelines to inform industry-led standardization for AI agents."
Agent control overlays. The COSIS project page lists single-agent and multi-agent use cases, but its updates show no agent overlay draft.
An NCCoE project description. The summary of comments says the NCCoE "intends to release a draft project description", and the project hub says "the ultimate deliverable will be an SP-1800 series practice guide". Neither has a date.
The full RFI analysis. Only the 800-5 abstract is available to cite.
Listening sessions. The February announcement now says the workshops "are still in planning stages."

Our assessment: no NIST page dates any of these, so plan with today's material rather than wait for industry-led standards.

What security leaders should do now

Use the ten tenets as an agent IAM checklist. Separate agent identities, no shared human credentials, zero standing privilege, short-lived audience-bound tokens and approval triggers your reviewers can sustain.
Keep policy outside the model. Put access decisions in deterministic code or a policy engine, not in the prompt. NIST's own wording, "Guardrails alone are insufficient", is useful in architecture reviews.
Make logs agent-proof. Store agent activity where the agent cannot write or delete it, per tenet 10.
If you run long-horizon agents or evaluations with internet access, read the Key Practices. See also our piece on Anthropic's report of unintended agent actions.
Map NIST to your other obligations. For EU exposure, see how the EU AI Act treats AI agents; for the wider picture, our agentic AI security landscape (October 2026).
Watch for the NCCoE draft project description, any COSIS agent overlay draft and the 800-5 PDF reappearing.

Frequently asked questions

Has NIST published an AI agent standard?

No. As of 1 November 2026, NIST has not published an AI agent standard. Its 2026 agent work so far is a request for information and a summary of responses, an NCCoE concept paper and a summary of comments, blog posts including the ten design tenets, and voluntary incident practices written with NSA and CISA.

What are NIST's design tenets for AI agent identity?

Ten tenets in a 27 October 2026 NIST blog post, "Design Tenets for Agent Identity Management Systems". They include distinct agent identities, delegation that narrows scope, zero standing privilege, short-lived audience-specific authorization and separating policy from reasoning. NIST calls them "an initial set"; they are not a standard or a formal NIST publication.

What did the NIST agent RFI find?

The abstract of NIST's summary of responses (report 800-5, 18 May 2026) says "Commenters widely agreed that AI agents present novel security threats and that these security concerns present a barrier to adoption." We cite only the abstract because the full PDF returned 404.

Does NIST's AI agent security work cover prompt injection?

Yes, in the design tenets. Tenet 07 separates policy from reasoning so that "prompt injections or malicious, untrusted data processed by the reasoning engine cannot manipulate credentials or expand the agent's actual permissions." The 16 October Key Practices, by contrast, treat prompt injection as an instructed action outside their definition of a control incident.

Sources

This article is news reporting. Bylines on AIAgentThreats are disclosed pen names of our editorial team. Spotted an error? Email info@aiagentthreats.com. See our Editorial Standards.