On October 27, 2026, four authors writing on NIST’s Cybersecurity Insights blog proposed ten design tenets for managing the identities of AI agents. The fifth tenet closes with a warning about human review itself: escalation to a human can become “so frequent that agentic actions are approved habitually, rather than through careful risk consideration.”
The post, Design Tenets for Agent Identity Management Systems, is the second in a NIST series on agentic identity, authentication, and authorization. The first post, from August 27, warned that early agentic deployments are “prioritizing feature development and immediate value over security” and named credential sharing with agents as a common pattern. Its authors say the tenets are drawn from public comments on a National Cybersecurity Center of Excellence (NCCoE) project and from engagement with stakeholders, and that they will be the guideposts for the NCCoE’s agentic demonstrations. The project’s resource hub reports that the February 2026 concept paper behind it drew over 600 responses, and that the eventual deliverable is an SP 1800 series practice guide with example implementations. NIST calls the ten “an initial set” and says not all of them will be immediately fulfilled by the current state of standards and technology.
Most of the ten tenets are checks one system runs on another
Read in order, the tenets describe infrastructure. Each agent gets a unique, cryptographically verifiable identity distinct from human users and service accounts. Agents are cryptographically linked to whoever initiated the task, and as authority passes to sub-agents, scopes attenuate so that “downstream entities can never claim more authority than the parent.” Agents hold zero standing privilege when idle, and access grants are just-in-time, time-bounded, and revocable.
The later tenets go further. Tenet 07 separates the logic that decides what an agent attempts from the systems that decide what it is allowed to do, because a language model takes data and instructions as one stream of tokens, and the post states plainly that “Guardrails alone are insufficient.” Tenet 08 keeps deterministic capabilities as the primary mechanism for access decisions, with probabilistic signals allowed only as an input. Tenet 10 calls for an append-only, tamper-evident body of evidence on the agent’s identity, the delegated intent, and the resulting actions, kept in logging infrastructure independent of the agent so a compromised agent cannot rewrite its own record.
This is solid engineering, and it is Responsible AI in the plain sense of the term: machine checking machine. An identity provider and a policy engine verify the agent and its scope, and a separate log verifies the history. None of it needs a person until something crosses a line.
Tenet 05 leaves the human ruling to each organization
That line is Tenet 05, Human-in-the-Loop Triggers. It reads: “Every organization defines risk thresholds and tolerances that, when reached, initiate human review of agentic actions.” Technology components route the escalation “to the correct authority for escalated decisions,” with enough information to support the review, including context beyond the condition that tripped the trigger. The stated rationale is direct: without enforced triggers for sensitive actions, a malfunctioning, hallucinating, or manipulated agent “could execute irreversible damage.”
The tenet defines when a human gets called and what that human should see. It does not say who the correct authority is or what that person may decide, and it leaves the record of the decision unspecified. For an identity design post, that boundary is reasonable, since those answers belong to the organization deploying the agent. They are also the answers that decide whether a human review is governance or a formality, and the consent fatigue warning points straight at that difference.
A trigger works only if someone on the other end can halt the action
Basil Puglisi’s working paper Why Agentic AI Was Always Going to Fail reduces this to the Named-Human Test, a single question: “Is there a named human who holds binding authority to approve, modify, or halt the output, and whose accountability survives an audit through at least one of the four channels (moral, professional, civil, criminal)?” The same paper says what fails the test: “a name on a form without authority, competence, evidence access, and a demonstrable record of override does not pass.” Habitual approval is that failure in operational form. A reviewer who approves every escalation out of habit is present, but the record no longer shows that anyone weighed the specific action.
Checkpoint-Based Governance supplies the record that tells the two apart. Every checkpoint closes on one of three logged outcomes, accept, modify, or reject, with the person who made the call on the record. Tenet 10 already asks for an evidence chain covering identity, delegated intent, and actions. Adding the human ruling at each escalation to that same chain would let an auditor see both what the agent did and who decided it could.
What deployers can write down now
Organizations building agent identity programs can treat Tenet 05 as a set of blanks to fill before go-live. For each risk threshold, name the role that rules on the escalation, and confirm that role can stop the action and has the competence and evidence access to judge it. Record every escalation outcome as accept, modify, or reject in the same tamper-evident log Tenet 10 describes, so the ruling and the agent’s actions sit in one place. Then measure the habit NIST warns about. Track the share of escalations closed as accept with no modification and the time spent per review. If that share keeps climbing while review time keeps falling, audit a sample of the approved decisions and check the reviewer’s workload before deciding whether the thresholds or the staffing need to change.
The NCCoE project is still in progress and accepts comments by email at AI-Identity@nist.gov, so the questions Tenet 05 leaves open can still reach the authors. NIST’s tenets make the agent prove who it is and what it was allowed to do. The organization still has to show which person decided, and that the decision could have gone the other way.
Sources
- Booth, H., Fisher, B., Galluzzo, R., & Clancy, T. (2026, October 27). Design tenets for agent identity management systems. Cybersecurity Insights, National Institute of Standards and Technology. https://www.nist.gov/blogs/cybersecurity-insights/design-tenets-agent-identity-management-systems
- Booth, H., Fisher, B., Galluzzo, R., & Roberts, J. (2026, February). Accelerating the adoption of software and AI agent identity and authorization [Draft concept paper]. National Cybersecurity Center of Excellence, National Institute of Standards and Technology. https://www.nccoe.nist.gov/sites/default/files/2026-02/accelerating-the-adoption-of-software-and-ai-agent-identity-and-authorization-concept-paper.pdf
- Fisher, B., & Galluzzo, R. (2026, August 27). Back to the future: Why agentic AI needs a strong identity foundation. Cybersecurity Insights, National Institute of Standards and Technology. https://www.nist.gov/blogs/cybersecurity-insights/back-future-why-agentic-ai-needs-strong-identity-foundation
- National Cybersecurity Center of Excellence. (n.d.). NCCoE Agentic SI identity and authorization project resource hub. National Institute of Standards and Technology. https://pages.nist.gov/nccoe-ai-identity/
FAQ
What did NIST publish on October 27, 2026?
NIST published Design Tenets for Agent Identity Management Systems on its Cybersecurity Insights blog. The post proposes an initial set of ten design tenets for identity, authentication, and authorization of AI agents across enterprise and consumer-facing use cases, and it is the second post in a series tied to an NCCoE project.
Are the NIST agent identity tenets a formal standard?
No. NIST describes them as an initial set and a starting point, notes that not all of them will be immediately fulfilled by current standards and technology, and says they will guide the NCCoE’s agentic demonstrations. The NCCoE project’s planned deliverable is an SP 1800 series practice guide.
What does Tenet 05 say about human review?
Tenet 05, Human-in-the-Loop Triggers, says every organization defines risk thresholds and tolerances that initiate human review of agentic actions when reached. Escalations go to the correct authority with enough information to review them, and the tenet warns about consent fatigue, where escalations become so frequent that agentic actions are approved habitually.
What is consent fatigue in agentic AI?
In the NIST tenets, consent fatigue describes human escalation that happens so often that reviewers approve agentic actions out of habit rather than through careful risk consideration. A human is still present, but the review no longer reflects judgment about the specific action.
How does the Named-Human Test apply to agent escalations?
The Named-Human Test asks whether a named human holds binding authority to approve, modify, or halt the output and whose accountability survives an audit through at least one of four channels: moral, professional, civil, or criminal. An escalation routed to a reviewer who lacks authority, competence, evidence access, or a record of overriding the system does not pass.
How can an organization detect habitual approval?
Log every escalation outcome as accept, modify, or reject with the reviewer named, and keep that record with the agent’s evidence trail. Then track the share of escalations closed as accept with no modification alongside time spent per review. A rising unmodified-accept share paired with falling review time is a signal to audit a sample of decisions and revisit the thresholds or the reviewer workload.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply