NIST publishes 10 design tenets for AI agent identity and access management
NIST researchers have published an initial set of 10 design tenets for identity and access management (IAM) systems that govern AI agents in enterprise and consumer-facing deployments. The guidance, authored by Harold Booth, Bill Fisher, Ryan Galluzzo and Tom Clancy, calls for cryptographically verifiable agent identities, zero standing privilege, short-lived and revocable authorization, human review above defined risk thresholds, and tamper-evident logging independent of the agent. NIST warns that guardrails alone cannot address prompt injection and privilege escalation, and that the reasoning layer must be architecturally separated from the authorization layer. The work will inform demonstrations by NIST's National Cybersecurity Center of Excellence (NCCoE). This is guidance, not an incident report, with no immediate exploitation reported.
Detalhes técnicos
- Agents require unique, cryptographically verifiable identities distinct from human users and service accounts, tied to a specific workload, environment and approved configuration, with a separate ICAM lifecycle.
- Task originators and agents should be cryptographically linked during execution; delegated scopes must attenuate to sub-agents so downstream entities cannot claim more authority than the parent.
- Zero standing privilege, just-in-time, time-bounded and audience-specific grants, continuous runtime verification per tool call/API invocation, and avoidance of long-lived bearer tokens and static secrets.
- Cryptographically signed mandates define intended outcomes and constraints, verifiable downstream for authorization, auditing and non-repudiation.
- Architectural separation of policy from reasoning: LLMs ingest data and instructions as a single token stream with no built-in control/data separation.
- Deterministic access decisions as the primary mechanism; probabilistic signals may inform but not drive authorization.
- Continuous monitoring with agent-specific metrics plus append-only, tamper-evident logging maintained independently of the agent, since a compromised agent could alter its own logs.
- NIST cites the 'confused deputy' attack (prompt injection abusing a broadly scoped agent) as requiring multiple tenets — linking/delegation, least privilege, policy/reasoning separation and deterministic enforcement — to mitigate.
Remediação
Organizations deploying agentic systems should map the tenets to the risk of the transactions they support, eliminate standing privileges and long-lived credentials for agents, enforce human escalation thresholds while designing against consent fatigue, and stand up independent append-only audit trails for forensic chain of custody.
Linha do tempo
-
NIST publishes 10 design tenets for AI agent identity and access management
ler a análise desta fonte ocultar
NIST researchers have published an initial set of 10 design tenets for identity and access management (IAM) systems that govern AI agents in enterprise and consumer-facing deployments. The guidance, authored by Harold Booth, Bill Fisher, Ryan Galluzzo and Tom Clancy, calls for cryptographically verifiable agent identities, zero standing privilege, short-lived and revocable authorization, human review above defined risk thresholds, and tamper-evident logging independent of the agent. NIST warns that guardrails alone cannot address prompt injection and privilege escalation, and that the reasoning layer must be architecturally separated from the authorization layer. The work will inform demonstrations by NIST's National Cybersecurity Center of Excellence (NCCoE). This is guidance, not an incident report, with no immediate exploitation reported.
Technical Details
- Agents require unique, cryptographically verifiable identities distinct from human users and service accounts, tied to a specific workload, environment and approved configuration, with a separate ICAM lifecycle.
- Task originators and agents should be cryptographically linked during execution; delegated scopes must attenuate to sub-agents so downstream entities cannot claim more authority than the parent.
- Zero standing privilege, just-in-time, time-bounded and audience-specific grants, continuous runtime verification per tool call/API invocation, and avoidance of long-lived bearer tokens and static secrets.
- Cryptographically signed mandates define intended outcomes and constraints, verifiable downstream for authorization, auditing and non-repudiation.
- Architectural separation of policy from reasoning: LLMs ingest data and instructions as a single token stream with no built-in control/data separation.
- Deterministic access decisions as the primary mechanism; probabilistic signals may inform but not drive authorization.
- Continuous monitoring with agent-specific metrics plus append-only, tamper-evident logging maintained independently of the agent, since a compromised agent could alter its own logs.
- NIST cites the 'confused deputy' attack (prompt injection abusing a broadly scoped agent) as requiring multiple tenets — linking/delegation, least privilege, policy/reasoning separation and deterministic enforcement — to mitigate.
Remediation
Organizations deploying agentic systems should map the tenets to the risk of the transactions they support, eliminate standing privileges and long-lived credentials for agents, enforce human escalation thresholds while designing against consent fatigue, and stand up independent append-only audit trails for forensic chain of custody.