NIST NCCoE publishes comments on agent identity

What was published?

The NIST National Cybersecurity Center of Excellence, or NCCoE, released a summary of comments on its concept paper. The paper covers software and agentic AI identity and authorization. NIST announced the summary on 29 September 2026.

The summary is hosted on a new online resource hub for the project. NIST says the hub will let the project publish and revise resources more quickly, alongside its blog series and special publications.

How much interest was there?

NIST reports that the concept paper received feedback from more than 600 commenters across industry, government and academia. It describes the level of engagement as exceptional.

What comes next?

Based on the feedback, the NCCoE's Secure Software Development project will provide the first implementation use case. It will demonstrate how AI agents can be identified, authenticated and authorized within the software development lifecycle.

NIST also said it will release resources and review feedback on a rolling basis, rather than through a fixed comment period.

Why does it matter for agent governance?

Identification, authentication and authorization are the base layer of agent governance. Without a reliable identity for each agent, inventory, ownership and audit all become guesswork. Government guidance on these basics tends to shape what auditors and procurement teams ask for later.

The register maps two of its 24 controls to the project's stated scope. Agent inventory (GOV-01) maps to identification. Per-action policy (GOV-06) maps to authorization. We did not map credential lifetimes to authentication, because the NIST page does not describe them.

What does it not cover yet?

The summary of comments is not final guidance. It does not set requirements for human approval, audit retention or board reporting. Those areas are covered, at different levels, by the EU AI Act and the NIST AI Risk Management Framework.

What should buyers do?

Follow the project's resource hub if your agents run in software development, since that is the first use case. When you assess vendors, ask how each one identifies an agent, how the agent authenticates and where authorization is checked for each action.

What will we recheck?

When the NCCoE publishes further resources, we will review the crosswalk and add mappings where the text supports them.

How does this fit the other frameworks?

The register's framework crosswalks show which controls each framework supports. The NCCoE crosswalk is the narrowest today, with two mappings. We expect it to grow as the project publishes implementation material.