STANDARDSApril 2026
Response to NIST NCCoE Concept Paper on AI Agent Identity and Authorization
Comment on identity, authorization and the boundary between access and legitimate action.
This response addresses the NIST NCCoE concept paper on AI agent identity and authorization.
It argues that identity answers who an actor is and access answers what it can reach, while neither answers whether a specific action is legitimate, on whose behalf, under what mandate and at what moment in time. The submission proposes mandate as an explicit artifact, action-time verification for consequential operations, and signed evidence as a deliverable of the authorization architecture rather than an afterthought.