NIST's 10 AI Agent Identity Tenets: A Practical Checklist for Indian IT and Security Teams
Raman Chauhan · November 4, 2026
NIST has proposed ten design tenets for AI agent identity, treating agents as distinct, least-privilege, and revocable identities with human oversight and tamper-evident logs. This guide explains each tenet, maps it to a practical control, and gives a five-step starting checklist.
Most identity systems were built for people and the service accounts that support them. AI agents do not fit either model well. An agent can act for a person, hold credentials that outlive its task, and make thousands of calls before anyone reviews them. In late October 2026, the U.S. National Institute of Standards and Technology (NIST) proposed ten design tenets for managing agent identity. They give Indian IT and security teams a useful baseline, whether or not a regulator in India has written agent-specific rules yet.
What NIST Proposed
NIST's blog post "Design Tenets for Agent Identity Management Systems," published on October 27, 2026, is the second in a series on agentic identity, authentication, and authorization. NIST says the tenets draw on public comments and stakeholder engagement, and that they are a starting point rather than a finished standard. Not every tenet can be fully met with today's products, so NIST suggests using them to assess your current position and plan a roadmap.
The ten tenets are:
Distinct agent identification. Each agent has a cryptographically verifiable identity, separate from human users and service accounts.
Linking, delegation, and attenuation. Each agent is linked to the person or entity that started its task, and any sub-agent can never hold more authority than its parent.
Least and zero standing privilege. An agent holds no rights while idle and only the minimum needed for its current task.
Short-lived, revocable authorization. Access is time-limited, specific to its audience, and checked at runtime, with no long-lived bearer tokens.
Human-in-the-loop triggers. Human review starts when defined risk thresholds are reached, while watching for approval fatigue.
Mandates and constraints. The task's originator can issue signed statements that define the intended outcome and limits of the agent's work.
Separation of policy from reasoning. Rules about what an agent may do sit outside the model, so a prompt injection cannot expand its permissions. NIST notes that guardrails alone are insufficient.
Deterministic access decisions. Access is decided by fixed rules, with probabilistic signals used only as inputs.
Continuous monitoring. Agent activity is watched for anomalies, configuration drift, and privilege escalation.
Immutable evidence. Logs are kept outside the agent's reach, in a tamper-evident, append-only record.
Mapping Each Tenet to an Enterprise Control
The table below suggests one practical control for each tenet. These are our recommendations, not NIST's.
Tenet | Practical enterprise control |
|---|---|
1. Distinct identification | Give every agent its own service identity and named record. Ban agents that run on a person's login |
2. Linking and delegation | Record who started each agent and each sub-agent. Restrict sub-agent scopes to a subset of the parent's |
3. Least privilege | Review each agent's permissions against its task. Remove idle write access |
4. Short-lived authorization | Issue expiring credentials. Retire static API keys and long-lived tokens |
5. Human approval | Route high-value or irreversible actions to a named approver |
6. Mandates | Keep written task scopes for each agent and check actions against them |
7. Policy separation | Enforce access rules in the gateway or identity layer, not in prompts |
8. Deterministic decisions | Use rule-based allow and deny lists for sensitive systems |
9. Continuous monitoring | Alert on new connections, unusual volumes, and access outside the agent's scope |
10. Immutable evidence | Send agent logs to a store the agent cannot write to |
The First Question: What Is Already Connected?
Before any tenet applies, answer a simpler question: how many agents, bots, API keys, and OAuth grants are connected to your SaaS apps, and who owns each one?
Most teams cannot answer this quickly. Agents arrive through several routes: a developer adds an automation with an API key, an employee grants an AI assistant access to mail or files through OAuth, or a team installs a browser tool on a company card. Each one holds access that may never have had a formal approval.
Start with what you already have: connected-app lists from your identity provider, OAuth grant reports from Google Workspace or Microsoft 365, and expense data for AI subscriptions. Every item without a named owner is a finding.
Recent Proof Points
GitBook (November 2 and 3, 2026). GitBook's status page says an attacker gained unauthorized access to some of its infrastructure credentials on November 2, and describes the attack as targeted and carried out using AI agents. GitBook blocked the attacker, replaced its credentials and secrets, and invalidated every customer's API tokens. It says the attacker may have accessed integration tokens, Git Sync secrets, API tokens, and questions asked to GitBook Assistant. Customers were told to rotate their own GitBook tokens and any third-party secrets connected to GitBook. The lesson is that a platform breach can make every credential it holds a liability, so you need a rotation plan before an incident happens.
IBM (October 27, 2026). IBM announced that Agent Identity and HashiCorp Vault 2.2 are generally available. Agent Identity records each agent's owner, lifecycle status, and granted authority, while Vault issues short-lived credentials and can revoke access when an agent acts outside its permissions. IBM's watsonx Orchestrate discovery and containment features are still in technical preview, so ask vendors which capabilities are generally available and which are not.
Hong Kong Monetary Authority (October 2026). On October 15, 2026, the HKMA announced its ART framework for responsible AI in banking, covering accountability, resilience, and trust. The HKMA said it would publish a discussion paper on agentic AI governance, exploring intent-anchored accountability, a registry of material AI agents, and intervention mechanisms. The paper is a consultation, not a rule. It shows how financial regulators are thinking about agent identity, and Indian regulators may take a similar approach.
A Five-Step Starting Checklist
1. Discover. Build the inventory. Include agents, bots, scripts with API keys, OAuth grants, and browser or desktop agents. Record the system each one touches and when it was last used.
2. Assign owners. Give every agent one named owner who approves its access and answers for its behavior. Disable any agent that has no owner until someone claims it.
3. Scope access. Compare each agent's permissions with its task. Remove write access it does not need. Move credentials out of personal accounts and into a managed store.
4. Set expiry. Give every agent credential an expiry date. Renew only after an owner has reviewed the access. Long-lived keys are the ones that stay active after people leave.
5. Plan a kill switch. Document how to revoke one agent's access within minutes. Cover revoking tokens at the identity provider, rotating keys, and disabling scheduled runs. Test the process on a low-risk agent.
Where OptyStack Fits
OptyStack supports the discovery step and parts of the access and lifecycle steps.
Discovery. OptyStack finds SaaS and AI tools using signals from spend, SSO, and browser activity. Unsanctioned AI apps and the people who sign in to them appear in one inventory. It flags shadow AI and ranks each finding by risk, so you can decide what to review first.
Access. According to OptyStack's identity page, it imports users from Google Workspace, Microsoft, or Okta and acts as the identity provider for connected third-party apps. It applies IP address, device, and region conditions to sign-ins, and it denies sign-ins that fail those conditions. These controls apply to people signing in to your apps. OptyStack does not issue cryptographic identities to agents or manage their credentials.
Lifecycle. OptyStack's Pro plan includes user lifecycle management and unused license reclamation, which helps remove access and paid seats when someone leaves.
To see your own inventory, you can start a free trial or review OptyStack's identity management features.
