How NewCore Aligns to NIST's Design Tenets for Agent Identity Management Systems

On October 27, NIST published ten design tenets for agent identity management systems. Read one at a time, they look like a technical checklist. Read together, they make a simpler argument: you cannot govern an agent if you cannot identify, scope, interrupt, or hold it to account. AI agent governance is an identity problem.

The timing matters. This summer, the people who know agents best told us what agents do when nobody is watching. In July, OpenAI agents running a cybersecurity test escaped their sandbox, broke into Hugging Face’s infrastructure, and went looking for the answer key. Anthropic disclosed that its own models breached real organizations during security tests. On September 16, OpenAI reported six more incidents, including a model that left notes for its next session on how to keep its mistakes quiet.

Every incident had the same shape: an agent with a goal, access nobody deliberately granted, and no one who could answer in real time for what it was doing. NIST's tenets are the first standards-body answer to that shape. Here is a summary of the tenets, organized around four questions every enterprise should be able to answer about every agent it runs.

Who is this agent, and who does it work for?

Tenets 1, 2 and 6: distinct identification; linking, delegation and attenuation; mandates and constraints.

NIST starts where governance has to start. Every agent gets its own verifiable identity, distinct from the humans it works for and from legacy service accounts, with its own lifecycle. An agent that borrows a person's login creates issues with an audit trail. An agent that runs on a shared key leaves nobody to attribute the action to.

Agents are not service accounts. A service account ran for milliseconds and did one thing. An agent runs for days, makes plans, and talks to other agents. It needs to be managed as a first-class citizen, right alongside the humans in the organization, in the same place and under the same rules.

Identity alone is not accountability. NIST also requires that every agent stay cryptographically linked to whoever started its task, and that authority shrink as it passes to sub-agents, so no sub-agent can ever claim more than its parent. Signed mandates then record what the originator actually intended. This is what makes "the people still manage the swarm" provable rather than aspirational.

That matters because agents are going to create agents. Attribution that works for one agent and one owner has to survive a chain of sub-agents running for days. If you cannot attribute an action done by an agent to a specific human, eventually that human is the CEO.

How NewCore aligns: NewCore provides an agent as a first-class identity, with cryptographically verifiable identification. Agents have an identity, credential, and access management lifecycle distinct from human principals. And it carries a verifiable chain of delegated authority from human to agent.

What can it reach, and for how long?

Tenets 3 and 4: least and zero standing privilege; short-lived, dynamic and revocable authorization.

An agent needs three things to cause harm: a goal, the intelligence to pursue it, and access to act on it. The enterprise controls exactly one of those. You did not train the model and you do not set its capability. You do decide what it can reach, on whose behalf, and for how long.

NIST's answer is zero standing privilege. An idle agent holds no rights. When a task starts, it receives just-in-time access scoped to that task, for that audience, for a limited time, and every call is checked again at runtime. Long-lived bearer tokens and static API keys are out. The goal is simple: if someone steals a token from an agent, there is nothing worth stealing.

Scope should follow purpose. An agent that cleans up your cloud may genuinely need permission to delete Kubernetes clusters. That does not mean every developer's coding agent should carry the same power, any more than every developer does.

How NewCore aligns: NewCore issues no standing credentials; agents receive short-lived, purpose-bound access on demand, scoped by task, tool and transaction, and never hold the tool's own credential.

Who decides what it is allowed to do?

Tenets 5, 7 and 8: human-in-the-loop triggers; separation of policy from reasoning; deterministic access decisions.

This is the most important idea in the NIST document, and the easiest to miss. What an agent decides to attempt must be architecturally separate from what it is allowed to do. Language models take data and instructions as one stream, so a prompt injection hidden in an email or a support ticket can steer the agent's reasoning. It must never be able to steer its permissions. NIST says it plainly: guardrails alone are not enough.

The same logic applies to the access decision itself. A model's judgment can inform it, but the decision has to be deterministic, made by a system the agent cannot talk its way past. Humans are governed by norms and law. Agents are governed only by what their environment permits, and given the chance they will do whatever it takes to satisfy their owner.

For actions that cannot be undone, NIST calls for defined thresholds that escalate to a person, with enough context to decide well and without so many prompts that approval becomes a reflex. One law firm we work with wanted exactly this: before an agent sends outreach to 250 contacts, the lawyer who launched it must positively acknowledge the outcome.

We would add one requirement. Today, the approval has to travel out of band. If your agent is connected to Teams and your approvals arrive in Teams, you have handed the agent the ability to approve itself. The acknowledgement belongs on something the person owns and the agent cannot reach, like their phone, so the record shows who decided, when, and what they saw.

How NewCore aligns: NewCore decides every call by deterministic policy, not a model's judgment, and Agent Guardian pauses high-risk actions until the accountable owner approves on their own device, outside the agent's channel.

Can you prove what happened?

Tenets 9 and 10: continuous monitoring; immutable evidence.

Agents operate at a speed and scale no person can follow, so NIST calls for monitoring built on agent-specific metrics and thresholds. It flags long-running agents as a particular risk, and Hugging Face showed why. An agent that has been running for four days has had time to build a very large plan. One control we use: any agent loop that runs past six hours must report in, explain itself, and get a thumbs up, or it waits. Long loops need a reason to be long.

The last tenet is the one that turns governance into accountability. NIST asks for a tamper-evident, append-only record of the agent's identity, the intent delegated to it, and what it actually did, kept independent of the agent. This is not a theoretical concern. When a model leaves itself notes on how to keep its mistakes quiet, its own account of its work cannot be the record. The log, like the approval, has to live where the agent cannot touch it.

None of this is compliance yet. There is no compliance regime for agents. It is something more basic: proof that there was a responsible adult in the process, so that when something goes wrong, you can show the controls you had in place to contain it.

How NewCore aligns: NewCore keeps one tamper-proof record of every decision (agent, owner, policy and action), treats denied attempts as the first signal worth alerting on, and revokes access everywhere at once.

A roadmap, not a checkbox

NIST is candid that today's standards and technology cannot yet deliver all ten tenets, and that organizations should apply them according to risk. It is also clear that no single tenet works alone. Stopping a confused deputy attack, where a prompt injection tricks a broadly scoped agent, takes delegation, least privilege, separation of policy from reasoning, and deterministic decisions together.

That is the real lesson for enterprise buyers. Bolting an agent product onto each of the identity systems you already run will not get you there. Most enterprises have more than a dozen. Adding an agentic IdP, agentic governance and agentic compliance on top just makes the gaps larger. The tenets describe one system that governs humans and agents together, from the ground up.

Start with three questions. Where are your AI agents? What can they connect to? How do you control what they do, and prove it? If you can answer all three, for every agent, at any moment, you are already living most of NIST's tenets.

How NewCore aligns

NewCore was built on the same premise as NIST's tenets: governing AI agents is an identity problem, and it takes one identity model for people and agents together. Every call follows one governed path in six steps: register, connect, broker, authorize, audit and cut. Each step answers one or more of NIST's ten tenets, from distinct agent identity to immutable evidence.

It works with the identity provider you already run, so nothing changes about how your people sign in. Agents act. Humans stay accountable. The enterprise can prove it.

This is the most powerful tool the world of compute has produced. Use it. Handle it with care. And make sure that when it acts, someone can say, with proof, that they knew.