STANDARDSJuly 2026
Comment on NIST SP 800-228A
Public comment on NIST SP 800-228A, addressing authorization for agentic systems and the boundary between access and legitimate action.
This comment responds to NIST SP 800-228A. It concentrates on a distinction the draft leaves implicit: an agent may be correctly identified and correctly granted access while still taking an action that no live human mandate authorizes.
The submission recommends treating authority as a first-class, time-bound object; requiring action-time checks rather than session-time grants for consequential operations; and specifying evidence requirements so that the basis for an agent's action can be reconstructed after the fact.