A note on NIST's agent-identity work and its four-area framing, which procurement teams are likely to bring to an evaluation. This page is distinct from the NIST AI RMF note, which addresses the risk-management framework; this one addresses the identity-and-authorization concept paper.
These pages describe the product. They are not a certification or a legal opinion.
Reading this note
The concept paper and NIST's project pages are authoritative for their content. The paper's public comment window ran February to April 2026 and has closed; this page cites the work descriptively, not responsively. Nothing here implies NIST review or endorsement of AAES.
Instrument identity
- Title
- NCCoE concept paper "Accelerating the Adoption of Software and AI Agent Identity and Authorization" (concept-paper stage, 2026)
- Issuing body
- National Institute of Standards and Technology: the National Cybersecurity Center of Excellence (NCCoE), with NIST CAISI coordinating US AI-safety evaluation work
- Instrument type
- Concept paper (pre-practice-guide); NIST AI 800-5 and adjacent AI RMF material provide the evaluation vocabulary. Not a standard, not a regulation.
- Official sources
- NIST CAISI and the NCCoE project pages.
The concept paper frames four capability areas for agent identity: agent identification, authorization, delegation, and non-repudiation logging.
Question
Against the four areas a procurement team will name — identification, authorization, delegation, non-repudiation logging — what can a reviewer inspect in AAES?
The four-area frame is a clean external description of what AAES already implements: identification maps to identity binding (AARM R6), authorization to authorization decisions (R4), delegation to the per-hop narrowing rules (R6.06), and non-repudiation logging to tamper-evident receipts (R5) and telemetry export (R8). All four areas have implemented, externally reviewed controls in the AAES tree.
Selected contribution
| Concept-paper area | What a reviewer can examine in AAES | Boundary |
|---|---|---|
| Identification | Every registered agent has a recorded identity with at least one accountable human manager; approvers are named and distinct from that manager role. | Recorded identity does not establish that the person behind a decision was authenticated at the moment of action. |
| Authorization | Every routed request gets an explicit permit or refusal against configured policy; actions classified as irreversible require approval by an authorized person; an agent cannot approve itself. | Recorded authorization does not establish that the underlying decision was correct. |
| Delegation | Delegation chains with verified per-hop narrowing: a delegated grant can only shrink in scope, never widen, and each hop is recorded. | Delegation records describe the chain as routed through AAES; activity outside AAES is visible only where telemetry is supplied. |
| Non-repudiation logging | One sealed, hash-chained record per action; telemetry export; offline integrity checks against a key AAES does not hold. | Integrity does not prove a complete action history or legal non-repudiation; the default deployment has zero independent witnesses. |
Preconditions and gaps
- Concept-paper stage. The project has not yet produced a practice guide; its framing may evolve, and this page will be re-dated when it does.
- No independent witnesses are configured by default. Independent attestation requires a configured external witness or timestamp authority and trust material obtained separately from the export.
- Credential-path control is required. Activity outside AAES is visible only where telemetry is supplied. Observation is not enforcement.
- No production adoption as of this review. Clients operate their own deployments; AAES does not offer a hosted deployment.
For implementation and testing details beyond this note, use Security and implementation posture and the evaluation page. Results from a client's test tenant are produced during a scoped evaluation.
Client responsibility
The organization answers its own risk and regulator questions. The concept paper's four areas are a discussion frame, not requirements AAES discharges for the client. The client remains the regulated entity.
Identify the credential path, actions, and evidence questions to examine in a client test tenant.