AI Agent Identity Management: NIST's 10 Design Tenets, Scored Against Okta, SailPoint, and Open Standards

NIST published ten design tenets for how AI agents should get identities, credentials, and permissions on October 27, 2026, written by three NIST identity and security staff and a MITRE engineer, per NIST's Cybersecurity Insights blog. Read as a checklist, it rules out a setup that is still common in production: an agent calling real APIs with a shared, long-lived API key.

We grouped the ten tenets into four questions you can paste into a vendor evaluation and scored the options a team can adopt this quarter against them. Our pick, up front: a regulated enterprise already paying Okta should extend that contract. A platform team running its own agents on Kubernetes should build on SPIFFE/SPIRE plus the Cross App Access pattern. A five-person startup should run the four-step baseline below this month and buy nothing yet.

What NIST published, and what it is not

The tenets come from public comments on the National Cybersecurity Center of Excellence (NCCoE) agent identity project, per NIST. It is a blog post, not a Special Publication, so nothing in it is a compliance requirement yet. NIST also concedes that not all of the tenets "will be immediately fulfilled by the current state of standards and technology."

That makes it a yardstick. A useful one, because the standards work is converging on the same shape. The IETF's WIMSE working group adopted an Agent Identity Management System draft, draft-ietf-wimse-aims-01, last updated November 2, 2026, which replaces an individual draft first posted in March 2026, per the IETF datatracker. Its authors include engineers from AWS, Ping Identity, and OpenAI. AIMS composes existing standards (SPIFFE, WIMSE, OAuth, OpenID Shared Signals) and calls static API keys "an antipattern for agent identity."

The ten tenets as four buyer's questions

A flat list of ten is hard to score, so we grouped the tenets under the four questions a security reviewer asks anyway. Numbers and names are NIST's.

1. Who is this agent, and who sent it? (tenets 01, 02, 06)

Distinct Agent Identification asks for a cryptographically verifiable identity separate from human users and service accounts, ideally tied to a specific workload and approved configuration. Agent Linking, Delegation & Attenuation requires a cryptographic link between the agent and whoever started the task, and scopes that shrink as work passes to sub-agents, so "downstream entities can never claim more authority than the parent." Mandates and Constraints goes one step further: the task originator can issue a signed mandate stating the intended outcome and limits, which downstream services verify.

Ask the vendor: Show me the cryptographic chain from this API call back to the human who started the task, and show me that a sub-agent's token carries narrower scopes than its parent's.

2. How much access, and for how long? (tenets 03, 04)

Least & Zero Standing Privilege means an idle agent holds no rights at all. Short-Lived, Dynamic & Revocable Authorization means every grant is just-in-time, time-bounded, and audience-specific, with runtime checks on each tool call and no long-lived bearer tokens or reusable static secrets.

The question to paste: What is the default lifetime of an agent credential, and how fast does revocation take effect mid-task?

3. Where is the access decision made? (tenets 07, 08)

Bucket 3 is where prompt injection does its damage. Architectural Separation of Policy from Reasoning exists because LLMs take data and instructions as one token stream, so a prompt injection can steer anything the model controls. NIST's phrasing is blunt: "Guardrails alone are insufficient." Deterministic Access Decisions adds that probabilistic signals (a risk score, a classifier verdict) can inform an access decision but cannot be the primary mechanism.

Ask: If the model is fully prompt-injected, which component outside the model still says no?

4. Who is watching, and what survives an incident? (tenets 05, 09, 10)

Human-in-the-Loop Triggers route decisions past a defined risk threshold to a person, and NIST warns about consent fatigue, where approvals become habitual. Continuous Monitoring wants agent-specific metrics and anomaly detection. Immutable Evidence asks for an append-only, tamper-evident record of the agent's identity, the delegated intent, and its actions, held in logging infrastructure the agent cannot modify.

And the last one: Can the agent, or anyone holding its credentials, alter or delete its own log entries?

The tenets also stack. NIST's example is the confused-deputy attack, where an injected prompt convinces a broadly scoped agent to act: blocking it takes delegation linking plus least privilege, separation of policy from reasoning, and deterministic decisions together, per NIST. A vendor that covers one bucket well has not covered the attack.

Where most agent stacks start

Gravitee's State of AI Agent Security 2026 report, published February 4, 2026 from a survey of more than 900 executives and practitioners, found that 88% of organizations had a confirmed or suspected AI agent security incident in the prior year, only 21.9% of teams treat agents as independent identity-bearing entities, and 45.6% still rely on shared API keys for agent-to-agent authentication, per Gravitee. Gravitee sells an AI agent gateway, so read it as a vendor survey; the identity numbers still match what NIST warns about.

A shared key fails four tenets in one move. It identifies no specific agent (01), links to no human (02), lives for months (04), and turns every log line into "the integration did it" (10). Replacing it is the first step under every option below.

Scoring the options

The vendor products are 2025 launches with 2026 updates, so we scored them on current documentation, not launch claims. Neither Okta nor SailPoint publishes a list price for its agent identity product; both pages route to sales or a demo.

Okta for AI Agents (plus Cross App Access)

Okta announced Okta for AI Agents and the Cross App Access (XAA) OAuth extension at Oktane on October 13, 2025, with AWS, Box, and Glean among the listed XAA backers, per iTnews. By May 14, 2026, Okta's newsroom listed an Amazon Bedrock AgentCore integration and support for non-Okta identity providers as "available now," per Okta.

Okta documents more runtime control than SailPoint. Its product page describes registering agents in Universal Directory with human owners and cryptographic credentials, issuing "ephemeral, secretless tokens," routing tool calls through an Agent Gateway that verifies user delegation and enforces least privilege, step-up human approval for high-risk actions, and a programmatic kill switch. That covers buckets 1 through 3 in substance, and the same page lists FedRAMP and HIPAA coverage for specific SKUs.

The gaps: XAA in Auth0 is still labeled Early Access, limited to Enterprise, B2B Pro, and B2B Essential plans, per Auth0's docs as last modified October 23, 2026. We found no documented signed-mandate artifact that maps to tenet 06. And Okta's logs stream to your SIEM, so immutability (tenet 10) is only as strong as the SIEM's retention and write controls.

SailPoint Agentic Fabric (formerly Agent Identity Security)

SailPoint made Agent Identity Security generally available at Navigate on September 30, 2025, alongside a Model Context Protocol (MCP) Server that brings SailPoint's identity services to agentic applications, per SailPoint's press release. The product page now says the product "has evolved into SailPoint Agentic Fabric."

SailPoint's strength is governance. The product page describes discovering agents across AWS, Azure, Google Cloud, and Salesforce, assigning one or more human owners, and reviewing and revoking agent access; the launch release adds tying agent activity to data "down to files, rows, and columns." That maps well to tenet 01 and the oversight half of bucket 4.

Runtime enforcement is where SailPoint trails the tenets. The September 2025 release listed just-in-time privilege and "Real-time Authorization" as roadmap items, and certification campaigns are periodic while tenets 03, 04, 07, and 08 are per-request. Ask sales to show real-time authorization in a production tenant before you score buckets 2 and 3, and plan on a separate runtime gateway or policy engine.

Open standards: SPIFFE/SPIRE plus Cross App Access

SPIFFE is an open specification for issuing short-lived cryptographic identity documents (SVIDs) to workloads; SPIRE, its open-source server, supports X.509 and JWT SVIDs, attestation-based issuance, and federation, per spiffe.io. AIMS says an agent "MUST be assigned exactly one WIMSE identifier, which MAY be a SPIFFE ID," so this path lines up with where the IETF draft is heading.

Registering an agent as its own workload, with a five-minute credential lifetime, is one command. Flags follow the SPIRE server CLI reference:

spire-server entry create \
  -spiffeID spiffe://acme.internal/agent/invoice-triage \
  -parentID spiffe://acme.internal/k8s-node \
  -selector k8s:ns:agents \
  -selector k8s:sa:invoice-triage \
  -x509SVIDTTL 300 \
  -jwtSVIDTTL 300

That entry covers tenet 01 (a distinct, attested identity) and most of tenet 04 (credentials that expire in minutes and rotate automatically). For delegation to SaaS apps, the Cross App Access pattern runs on the IETF's Identity Assertion JWT Authorization Grant (ID-JAG), now at draft 06 in the OAuth working group, per the IETF datatracker. The client exchanges the user's ID token at the enterprise IdP for an ID-JAG aimed at one resource, so the enterprise IdP's policy decides whether that connection is allowed:

POST /oauth2/token HTTP/1.1
Host: idp.acme.example
Authorization: Basic <CLIENT_CREDENTIALS>
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:token-exchange
&requested_token_type=urn:ietf:params:oauth:token-type:id-jag
&audience=https://auth.crm.example
&scope=contacts.read
&subject_token=<USER_ID_TOKEN>
&subject_token_type=urn:ietf:params:oauth:token-type:id_token

The client then presents the ID-JAG to the resource's authorization server with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer to get a scoped access token. Auth0 describes XAA as "the protocol solution behind MCP's Enterprise-Managed Authorization extension," per Auth0's docs, so MCP servers are the natural first target.

The gap: buckets 3 and 4 are yours to build, meaning a policy engine outside the model (the SPIFFE docs include Envoy plus OPA examples), an approval flow, and an append-only log store. No license fee, but real platform-team time.

The do-nothing-yet baseline

For a handful of internal, mostly read-only agents, buying a product is premature. The minimum that gets you off shared keys takes four steps: one credential per agent from your cloud's existing workload identity, the shortest token lifetime your providers allow, a named human owner per agent in whatever registry you already keep, and agent logs shipped to a bucket the agent's credentials cannot write to. That partially covers tenets 01, 03, 04, and 10 and defers delegation and policy separation.

The scorecard

Scores reflect public documentation as of November 4, 2026. "Partial" means the docs cover some of the bucket's tenets, not all.

NIST bucket	Okta for AI Agents + XAA	SailPoint Agentic Fabric	SPIFFE/SPIRE + ID-JAG	Do-nothing-yet baseline	Source
1. Identity and delegation (01, 02, 06)	Partial: registry, owners, delegation checks; XAA in Early Access	Partial: discovery, owners, user linkage	Partial: attested IDs, ID-JAG delegation	Weak: per-agent key and owner	Okta, SailPoint, IETF
2. Privilege and time (03, 04)	Covered: ephemeral tokens, kill switch	Partial: reviews and revocation; JIT on Sept 2025 roadmap	Covered: short-TTL SVIDs	Partial: short token lifetimes	Okta, SailPoint, SPIRE
3. Policy outside the model (07, 08)	Covered: Agent Gateway per tool call	Gap: add a runtime gateway	Build: Envoy/OPA or similar	Gap	Okta, spiffe.io
4. Oversight and evidence (05, 09, 10)	Partial: step-up approval, SIEM logs	Partial: certifications, observability	Build	Partial: write-protected logs	Okta, SailPoint
Pricing	Sales-gated	Demo-gated	No license; engineering time	No new spend	Okta, SailPoint

No option covers all ten tenets today, which matches NIST's own caveat. Signed mandates (tenet 06) are undocumented in every column.

The pick by team profile

Solo builder or a team under ten people with a few internal agents: run the baseline this month and buy nothing. Add the four questions to your code-review template so every new agent answers them before it ships.

Startup or platform team running agents on Kubernetes, especially if you sell to enterprises: build on SPIFFE/SPIRE for agent identity and implement the ID-JAG flow for SaaS and MCP access. Enterprise buyers' IT teams will ask for IdP-controlled connections, and the IETF drafts give you a spec to point at. Budget the policy engine and log store as roadmap items.

Regulated enterprise already on Okta for workforce identity: buy Okta for AI Agents. It has the stronger runtime story of the two vendors and now works alongside non-Okta IdPs. Add your own write-once evidence store for tenet 10.

Enterprise whose identity program runs on SailPoint governance: use Agentic Fabric for inventory, ownership, and certification, and pair it with a runtime gateway for buckets 2 and 3. Don't credit it with just-in-time access until you've seen that feature in a live tenant.

Whichever row you're in, start with the shared keys. Find every agent that authenticates with one and give it its own short-lived credential and a named owner. That closes the gap the survey data and the NIST tenets both point to first.