← Research
STANDARDSJuly 2026

Comment on NIST SP 800-228A

Public comment on NIST SP 800-228A, addressing authorization for agentic systems and the boundary between access and legitimate action.


This comment responds to NIST SP 800-228A. It concentrates on a distinction the draft leaves implicit: an agent may be correctly identified and correctly granted access while still taking an action that no live human mandate authorizes.

The submission recommends treating authority as a first-class, time-bound object; requiring action-time checks rather than session-time grants for consequential operations; and specifying evidence requirements so that the basis for an agent's action can be reconstructed after the fact.

Subscribe to updates from the lab

Research releases, product notes and occasional letters. Low volume. No marketing.