DefinitionNIST NCCoE · OWASP ASI03Version 1.025 October 2026

AI agent identity: every agent under its own name and scope

AI agent identity is the distinct, revocable identity under which one AI agent authenticates to systems and tools, separate from the identity of the employee or service it works for, so that its permissions can be scoped to its task, each of its actions can be attributed to it, and its access can be revoked on its own. This entry sets out why a shared identity fails, the 3 controls that make an agent identity real, and what NIST is preparing, read in primary sources on 25 October 2026.

Book a 30‑min call Read the 3 controls
Control plane (C4): who may act, with which rights, and how it stops.
Identity
One per agent, issued by the enterprise identity provider
Controls
GOV-A-01, GOV-A-02 and GOV-A-04
NIST
NCCoE concept paper, draft, February 2026
Status checked
25 October 2026, in primary sources
On this page
  1. Definition and conventions
  2. 1. Why a shared identity fails
  3. 2. Authenticate, authorize, revoke
  4. 3. What NIST is standardizing
  5. 4. The identity in the audit trail
  6. 5. Questions buyers ask
  7. 6. References and sources
  8. 7. Versioning and citation
0 · Definition and conventions

An agent that borrows a person’s identity leaves a record that names the wrong actor.

In this entry, "we" means Hikari Blue, which engineers and operates the AI operating layer in which each agent runs under its own identity. The definition is ours; the NIST, OWASP and EU texts it cites are read in their primary sources, listed in section 6.

3 identities are often confused. The employee’s identity says who the agent works for. A service account says which software runs. An agent identity says which agent acted, within which scope, and can be revoked without touching the other 2.

1 · Why a shared identity fails

Why a shared identity fails

There are 2 ways to share an identity: borrow the employee’s session, or pool several agents under one service account. Both break attribution and revocation.

  • Under the employee’s session

    Our briefing of 7 August 2026 describes an agent that drives desktop Chrome with the employee’s saved credentials. The target application authenticates, authorizes and logs a person, so attribution has to be rebuilt outside it.

  • Shared-identity agents

    Several agents acting under one service account. No action is attributable and no single agent can be halted alone, so it fails C4.

  • OWASP ASI03 · Identity and Privilege Abuse

    OWASP writes that without “a distinct, governed identity of its own”, an agent operates in “an attribution gap” that makes enforcing true least privilege impossible.

  • A revocation that locks out the employee

    An agent that holds the employee’s credentials cannot lose its access without the employee losing theirs. The stop then waits for someone to accept that cost.

2 · Authenticate, authorize, revoke

Authenticate, authorize, revoke: 3 controls

Each control has a statement, an evidence an auditor can ask for, and an identifier in our governance framework.

Control What it requires Evidence Framework control
Authenticate Each agent holds its own identity from the enterprise identity provider, never a shared service account, and appears in the agent register. The agent register, reconciled against the identity provider. GOV-A-01 · One identity per agent
Authorize Each agent’s tools, data and spend are declared; any call outside that scope is denied before execution and logged with the policy version that fired. The permission matrix and the denial log. GOV-A-02 · Declared scope and budget
Revoke The agent’s sessions and tool permissions are withdrawn in one action by a named operator or verifier, without disabling the employee or the other agents. The kill switch runbook and its drill history, with measured halt times. GOV-A-04 · Stop path and drill

Delegation. When an agent acts for a person, its identity is linked to that person’s, so that every action traces back to someone accountable. The NIST NCCoE concept paper sets the same aim: link user identities to agents to maintain accountability for the actions of automated systems.

NIST SP 800-207, Zero Trust Architecture (August 2020), grants access to each enterprise resource “on a per-session basis” and states that authentication and authorization to one resource “will not automatically grant access to a different resource.” In our reading, an agent identity is what lets that rule apply to agents.

OWASP recommends task-scoped, time-bound permissions, “using per-agent identities and short-lived credentials.” Short-lived credentials make revocation the default: a credential that is not renewed expires on its own.

NIST SP 800-63-4, Digital Identity Guidelines, published in July 2025, supersedes SP 800-63-3 and covers the identity proofing, authentication and federation of users. In our reading, it governs the person who delegates; the NCCoE concept paper lists it among the guidelines it will apply to agents.

Mapping prepared by Hikari Blue; NIST and OWASP have not reviewed it.

3 · What NIST is standardizing

What NIST is standardizing on agent identity and authorization

2 workstreams at NIST address agent identity. Neither had published a final guideline on 25 October 2026, when we read their pages.

  • NCCoE · Accelerating the Adoption of Software and AI Agent Identity and Authorization

    Draft concept paper by Harold Booth, Bill Fisher, Ryan Galluzzo and Joshua Roberts, released on 5 February 2026 and open for comment until 2 April 2026. It proposes an NCCoE project that applies existing identity standards to software and AI agents in enterprise use cases.

  • Its 5 areas of interest

    Identification, so access systems tell agents from humans; authorization; access delegation, linking user identities to agents; logging and transparency, linking each action to the identity of the non-human entity; tracking data flows.

  • The standards it considers

    Model Context Protocol, OAuth 2.0 and 2.1 with their extensions, OpenID Connect, SPIFFE and SPIRE, SCIM and Next Generation Access Control, with NIST SP 800-207, SP 800-63-4 and NISTIR 8587.

  • After the comment period

    The NCCoE project hub reports more than 600 responses and a project being stood up, whose ultimate deliverable is an SP 1800 series practice guide. The hub listed no published guide when we read it.

  • CAISI · AI Agent Standards Initiative

    Announced on 17 February 2026 by the Center for AI Standards and Innovation at NIST, on 3 pillars: industry-led agent standards, community-led open protocols, and research in AI agent security and identity.

  • What we take from it

    In our reading, both workstreams treat the agent as an identity of its own, distinct from the person it serves. That is the property control GOV-A-01 already requires.

Mapping prepared by Hikari Blue; NIST has not reviewed it.

4 · The identity in the audit trail

The identity in the audit trail

Actor identity is the first of the 9 fields of our AI audit trail: the agent or operator identity issued by the enterprise identity provider, never a shared service account.

  • Why the field matters

    Every action has one accountable identity. The field serves Article 12(2)(c) and Article 26(5) of the EU AI Act, which concern the monitoring of operation.

  • What a shared identity writes

    Under a person’s session, the field names the employee. Under a pooled service account, it names no one in particular. In both cases the record is complete in form and wrong in substance.

  • The human verifier

    The human verification field records the identity of the person who approved, rejected or overrode an output. Agent and verifier are 2 identities, never one.

  • The NIST aim

    The NCCoE concept paper sets logging and transparency as an area of interest: link each agent action “to the identity of the non-human entity”.

5 · Direct answers

The questions asked about AI agent identity.

What is AI agent identity?

The distinct, revocable identity under which one AI agent authenticates to systems and tools, separate from the identity of the employee or service it works for. Its permissions are scoped to its task, each of its actions is attributed to it, and its access can be revoked on its own.

Why can’t an agent use the employee’s credentials?

Because the target system then authenticates, authorizes and logs the person, not the agent. No action can be attributed to the agent, and its access cannot be withdrawn without locking out the employee. OWASP lists the risk as ASI03, Identity and Privilege Abuse, in its Top 10 for Agentic Applications of 9 December 2025.

What is NIST doing on agent identity and authorization?

The NCCoE released a draft concept paper on 5 February 2026, open for comment until 2 April 2026; it reports more than 600 responses and plans an SP 1800 series practice guide. On 17 February 2026, CAISI announced the AI Agent Standards Initiative, which includes research in AI agent security and identity.

Is a service account enough for an agent?

Not when several agents share it: no action is attributable and no single agent can be halted alone. One identity per agent, issued by the enterprise identity provider and listed in the agent register, is what control GOV-A-01 of our governance framework requires.

How do you revoke one agent without stopping the others?

Revocation targets the agent’s own identity: its sessions and tool permissions are withdrawn in one action, and the other agents keep running. That is the pass condition of control C4 of our Reference Architecture.

6 · References

Reference documents and primary sources.

Every date, identifier and quotation on this entry comes from the sources below, consulted on 25 October 2026.

Reference documents

Primary sources, consulted on 25 October 2026

7 · Versioning and citation

How to cite this document.

This URL is permanent and always serves the current version. Each change of substance increments the version and is listed in the changelog below, so a citation stays traceable to the text it quoted.

  • Preferred citation

    Hikari Blue, "AI agent identity: every agent under its own name and scope", Glossary of the AI operating layer, v1.0, 25 October 2026, https://hikariblue.com/glossary/ai-agent-identity

    Section anchors are stable: #definition, #shared-identity, #controls, #nist, #audit-trail, #faq, #references, #cite.

  • Changelog

    v1.0 · 25 October 2026. First public version.

    License. Published under CC BY 4.0: free to cite, quote and reuse with attribution to Hikari Blue and a link to this page. The license covers Hikari Blue’s text, tables and diagrams on this page; it does not cover third-party data, quotations or legal texts, which keep their own terms, nor the Hikari Blue name and logo, trademarks of UNITED4 LLC.

For CISOs, identity architects and internal auditors

Name every agent you run. Find the ones that share an identity.

30 minutes with a named partner. We take one workflow where agents act today and check each agent: its own identity, its declared scope and its revocation path. You leave with the list of agents that borrow a person’s session or share an account, whether or not we work together.

  • Every agent of one workflow, named
  • Its scope, declared or inherited
  • Its revocation path, walked on paper
Book a 30‑min call Or read the agent controls of the implementation guide Verify Hikari Blue with a model we do not control