NIST Unveils 10 Core Tenets for Secure AI Agent Identity and Authorization

The National Institute of Standards and Technology (NIST) has published 10 core tenets designed to provide a robust framework for securing AI agent identity and authorization. These tenets aim to maximize the benefits of AI agents while keeping their inherent risks in check, thereby fostering faster and more confident adoption of agentic technologies across both enterprise and consumer use cases. This initiative serves as NIST's foundational blueprint for how AI agent identity systems should be constructed. This development is significant for cloud and DevOps practitioners because it directly addresses the burgeoning security challenges introduced by autonomous AI agents. As AI agents evolve beyond simple chatbots to systems capable of planning and executing complex workflows, they increasingly require access to sensitive data and infrastructure. The traditional access control models designed for human users and managed devices are often insufficient for these non-human identities. The NIST tenets provide a standardized approach to manage these new identities, ensuring that agents operate within defined boundaries and that their actions are auditable. Without such a framework, organizations face a heightened risk of "shadow AI sprawl," where uncontrolled agent deployments can lead to compliance risks, technical debt, and unreliable outcomes. This move by NIST aligns with a broader industry trend emphasizing governance and security as AI agents transition from experimental pilots to production-grade deployments. Reports indicate that while enterprise adoption of AI agents is rapidly increasing, a significant governance gap persists. Companies like BeyondTrust and Sysdig are also launching new security solutions specifically tailored for AI agents, focusing on distinguishing agent actions from human actions and enforcing policy checks at runtime. The need for robust identity and access management for AI agents has become a top priority for enterprise buyers, with agent-to-agent, agent-to-resource, and agent-to-device access ranking high among access control concerns. In practice, this means that organizations deploying AI agents must prioritize implementing distinct identities for each agent, limiting their delegated authority, ensuring revocable permissions, and maintaining independent audit trails. Practitioners should evaluate their current identity and access management (IAM) strategies to determine how they can be extended or adapted to accommodate AI agents. This includes exploring solutions that offer runtime security and governance, capable of evaluating each agent action in real-time against organizational policies. Furthermore, the framework underscores the importance of clear visibility into agent activity and the ability to restrict or revoke access immediately if an agent's behavior becomes risky. Adhering to these tenets will be crucial for building secure, scalable, and compliant AI agent deployments, moving beyond mere deployment to achieving measurable and trustworthy business outcomes.