On October 27, NIST published ten design tenets for agent identity management. If you work in identity, nothing on the list will surprise you. Agents need their own identities. They shouldn't hold privileges while idle. Access should be short-lived and revocable. High-risk actions need a human. Policy can't live inside the model. And every action needs a record the agent can't touch.
For two years, "secure agents" has meant whatever the vendor in the room needed it to mean. Until now, buyers had no neutral yardstick. Security leaders should treat these tenets as a procurement checklist, starting today.
The Agent Identity Tenets#
The tenets come from NIST's National Cybersecurity Center of Excellence (NCCoE) agent identity project, shaped by public comments and stakeholder input.
| # | Tenet | What it requires |
|---|---|---|
| 01 | Distinct agent identification | Agents get their own verifiable identities, separate from humans and service accounts |
| 02 | Linking, delegation and attenuation | Authority narrows as it passes downstream; no sub-agent claims more than its parent |
| 03 | Least and zero standing privilege | No persistent rights when idle; minimum access per task |
| 04 | Short-lived, revocable authorization | JIT, time-bound access verified on every tool call; no long-lived bearer tokens |
| 05 | Human-in-the-loop triggers | Risk thresholds route decisions to the right human, with context |
| 06 | Mandates and constraints | Signed statements of intended outcome that downstream services can verify |
| 07 | Separation of policy from reasoning | What the agent attempts is decided apart from what it's allowed to do |
| 08 | Deterministic access decisions | Probabilistic signals inform; deterministic rules decide |
| 09 | Continuous monitoring | Agent-specific baselines and thresholds catch drift and compromise |
| 10 | Immutable evidence | Tamper-evident, append-only records kept independent of the agent |
Three details deserve particular attention:
"Guardrails alone are insufficient." That's NIST's phrasing under tenet 07. LLMs process data and instructions as one token stream, so any control that lives in the prompt can be talked out of. Enforcement has to sit outside the model, by architecture.
Consent fatigue is a design requirement. Tenet 05 doesn't stop at "add a human." It says escalation design must account for people who approve requests by habit. An approval flow that fires on every action trains reviewers to click yes.
No single tenet works alone. NIST's own example is the confused deputy: a prompt-injected agent with broad access. Stopping it takes delegation, least privilege, separation of policy from reasoning, and deterministic decisions working together. This is a system, and it should be evaluated as one.
Where most teams are starting from#
NIST's tenets describe where agent identity needs to go. For most teams, today's starting point looks different.
A developer wires an MCP server into their IDE with a personal access token pasted into a config file. The agent now holds everything that developer holds, all the time, with no expiry. A platform team stands up a shared service account so three different agents can reach the data warehouse. Nobody can tell which agent made which query. The security model for destructive actions is a line in the system prompt that says "never delete production data." Logs, when they exist, live in the agent's own runtime.
Each of those patterns maps to a tenet: distinct identities (01), zero standing privilege (03), short-lived access (04), policy outside the model (07), and independent evidence (10). These setups exist for a reason. Teams were told to ship AI, the governed path didn't exist yet, and they built the fast one.
That's why implementation matters as much as the principles. The governed path has to be the fastest path. Any control that adds a ticket queue between an engineer and the tool they need will get routed around. Make the secure path fast, and teams adopt the tenets by default.
What the tenets look like in production#
We built the C1 MCP Gateway to put identity-aware policy in front of every MCP tool call, outside the model, on the path agents already use. Here's how C1’s MCP gateway lines up with the list from NIST:
| NIST tenet | How the C1 MCP Gateway handles it |
|---|---|
| 01 Distinct identification | Standalone agents get their own identity. Workloads authenticate through federation. |
| 02 Delegation and attenuation | An agent acting for a person inherits that person's current identity and grants, never broader access. |
| 03 Zero standing privilege | Access is granted only for the tools and duration a task needs, then removed. |
| 04 Short-lived, revocable authorization | Access is rechecked on every tool call. Revoke it and the next call stops. Agents never hold secrets; connections are bound with DPoP. |
| 05 Human-in-the-loop | Tools are graded by risk. Reads auto-approve, writes route to an approver, destructive calls are denied by default. |
| 07 Policy separated from reasoning | Every proxied call passes through the gateway, which evaluates identity, current access, action risk, and company policy. The model never sees the decision logic. |
| 08 Deterministic decisions | Policy sets the risk grades and the outcome: approve, escalate, or deny. |
| 10 Evidence | The gateway records caller, tool, requested action, policy decision, approval, and outcome, outside the agent's runtime. |
Two choices we made matter here:
First, risk grading is how you beat consent fatigue. If every action needs approval, approval means nothing. Auto-approving low-risk reads keeps humans focused on the writes and destructive calls that deserve their attention.
Second, speed. Engineers request tools from Slack, Teams, the CLI, or their IDE, and policy grants access in seconds. With 3,000+ MCPs available out of the box, the governed path is also the shortest one. That's what makes zero standing privilege survivable in practice.
NIST is candid that today's standards can't deliver all ten tenets in every deployment model. Signed mandates (06) depend on standards still taking shape across the industry — work like enterprise-managed authorization (EMA) is part of closing that gap. Treat the list as a roadmap, and judge vendors on how much of it they deliver now.
Five questions to ask this week#
You don't need to wait for the NCCoE demonstrations to put this list to work. Take it into your next agent review and ask:
- Can you list every agent in your environment, each with an identity separate from a human or a shared service account?
- What does each agent hold when it's idle?
- Where does the access decision happen: inside the model, or outside it?
- Which actions reach a human, and does that human get enough context to say no?
- If an agent were compromised, could it edit its own logs?
NIST took the security model identity teams already trust — zero standing privilege, verified access, and evidence you can defend — and applied it to a new kind of actor. Agents will soon outnumber the humans in most environments. They deserve the same rigor, delivered at agent speed.
See how the C1 MCP Gateway puts the tenets in front of every tool call
