NIST’s 10 Design Tenets for Agentic AI Identity: What Healthcare Security Teams Need to Know

AI Security Series

On October 27, 2026, NIST published what it calls an "initial set" of design tenets for agentic AI identity, authentication, and authorization. The 10 tenets — authored by Harold Booth, Bill Fisher, and Ryan Galluzzo of NIST and Tom Clancy of MITRE — are drawn from public comments on the NCCoE's project on software and AI agent identity and authorization, and from extensive stakeholder engagement.

They are not a standard, a mandate, or a compliance checklist. NIST is explicit that the tenets should be applied based on the risk of the agentic transactions an organization supports, the environment those agents operate in, and the data and tools they can touch. But they are the clearest statement yet from the U.S. government's identity specialists about what good looks like for agentic IAM — and they will serve as the design guideposts for the NCCoE's upcoming agentic demonstrations. A NIST Special Publication formalizing conformity criteria is described as forthcoming.

Context: Why Now

This is the second post in a NIST blog series on agentic identity. The first, published August 27 by Fisher and Galluzzo, made a pointed argument: early agentic deployments are repeating a familiar pattern, prioritizing features and immediate value over security. It singled out several common practices as hazardous — most notably, running agents under borrowed human credentials and service accounts, which remains the dominant deployment pattern in production environments today.

The 10 tenets are NIST's answer to what a correctly designed agent identity management system should look like. They build on existing IAM foundations — least privilege, zero standing access, separation of duties — and extend them to handle the specific properties that make agents different: they act autonomously, they can invoke other agents, they process untrusted external data, and they can act faster and at greater scale than any human operator.

The 10 Tenets

NIST groups the tenets into four themes. The table below maps each tenet to its theme and the primary risk it mitigates.

#	Tenet	Theme	Primary Risk Mitigated
1	Distinct Agent Identification	Know who the agent is	Agent impersonation; unattributed autonomous actions
2	Agent Linking, Delegation & Attenuation	Know who the agent is	Non-repudiation gaps; overly broad execution authority
3	Least & Zero Standing Privilege	Limit the agent's power	Lateral movement; privilege accumulation; hijacked agent access
4	Short-Lived, Dynamic & Revocable Authorization	Limit the agent's power	Token/credential compromise; inability to interrupt a hijacked agent
5	Human-in-the-Loop Triggers	Limit the agent's power	Unchecked high-impact harm from malfunctioning or manipulated agents
6	Mandates and Constraints	Limit the agent's power	Unbounded task execution; loss of accountability
7	Architectural Separation of Policy from Reasoning	Keep the model out of access decisions	Prompt injection; privilege escalation; unintended actions
8	Deterministic Access Decisions	Keep the model out of access decisions	Prompt injection impact; inconsistent behavior near sensitive data
9	Continuous Monitoring	Watch everything, keep the records	Undetected compromise; configuration drift; privilege escalation
10	Immutable Evidence	Watch everything, keep the records	Log tampering by compromised agents; audit and forensic failure

Know Who the Agent Is (Tenets 1–2)

Tenet 1 (Distinct Agent Identification) requires that each agent have a unique, cryptographically verifiable identity — separate from human users and service accounts — ideally tied to a specific workload, environment, and approved configuration, with its own credential lifecycle. The goal is traceability: when an agent takes a high-impact action, that action must be attributable to a specific software component, not to a generic service account shared across workloads.

Tenet 2 (Agent Linking, Delegation & Attenuation) requires that agents remain cryptographically linked to the entity that assigned their task throughout execution. As authority passes from a human to an orchestrator to a sub-agent to a downstream service, the scope can only narrow — no downstream entity can hold more authority than its parent. This is the principle NIST uses to constrain multi-agent chains: a compromised sub-agent cannot escalate beyond the authority it was originally delegated.

Limit the Agent's Power (Tenets 3–6)

Tenet 3 (Least & Zero Standing Privilege) is familiar from zero trust: agents hold no persistent rights when idle. Access is scoped to the minimum required for a specific task, and separation of duties prevents agents from accumulating conflicting privileges.

Tenet 4 (Short-Lived, Dynamic & Revocable Authorization) extends least privilege into the temporal dimension. Access is just-in-time and time-bounded — every tool invocation, API call, and resource access is verified at runtime against current context and risk. Long-lived bearer tokens and static reusable secrets are explicitly rejected. Revocability is the operative word: a hijacked agent mid-task can be interrupted.

Tenet 5 (Human-in-the-Loop Triggers) acknowledges that some decisions shouldn't be made autonomously. Organizations must set risk thresholds that route sensitive actions to human review, with enough context for a meaningful decision. Critically, NIST flags consent fatigue as a design constraint: escalation prompts must be rare enough to get real scrutiny.

Tenet 6 (Mandates and Constraints) gives task originators a formal mechanism: cryptographically signed mandate statements that define intended outcomes and the limits on how to reach them. Downstream services can verify these signatures and use them in authorization decisions. In consumer scenarios, mandates should avoid unnecessary disclosure of user data.

Keep the Model Out of Access Decisions (Tenets 7–8)

These two tenets are where NIST makes its most direct statement about the limits of AI-native approaches to security.

Tenet 7 (Architectural Separation of Policy from Reasoning) requires that the logic deciding what an agent attempts be architecturally separate from the systems deciding what it is allowed to do. NIST's reasoning is explicit: because language models process data and instructions in the same token stream, enforcement must be built into the architecture around the agent. The document states directly that guardrails alone are insufficient. An agent that can be prompted into ignoring its own safety instructions is not a security control — it's a risk factor.

Tenet 8 (Deterministic Access Decisions) follows from that logic. Access decisions should rest primarily on deterministic mechanisms. AI-generated risk scores and probabilistic signals may inform a decision, but they should not make it. This is a consequential constraint for organizations that have positioned AI-driven behavioral analytics as a primary control: in NIST's framework, those signals are inputs, not verdicts.

Watch Everything, Keep the Records (Tenets 9–10)

Tenet 9 (Continuous Monitoring) recognizes that agents operate at machine speed. Monitoring needs agent-specific metrics, thresholds, and policies — baseline human-user monitoring won't scale. Risk is highest for long-running agents and agents that use many tools, where configuration drift and privilege creep are most likely to go undetected.

Tenet 10 (Immutable Evidence) requires a tamper-evident, append-only record of each agent's identity, delegated intent, and actions — held on logging infrastructure independent of the agent itself. An agent that can alter its own logs can erase its tracks. The logging infrastructure must be treated as a separate trust domain.

What NIST Means by "Tenets Work Together"

NIST uses the confused deputy attack as its example. The confused deputy is a classic privilege escalation: a trusted intermediary (here, an agent) is manipulated into exercising authority on behalf of an attacker. Blocking it requires least privilege (Tenet 3) to limit what the agent can access, policy separation (Tenet 7) to prevent the model from being manipulated into bypassing controls, and deterministic decisions (Tenet 8) to ensure access logic can't be reasoned around. Any one tenet in isolation is insufficient. The framework is designed as a system.

What This Means for Healthcare

Healthcare organizations are actively deploying agentic AI — clinical decision support, prior authorization automation, revenue cycle agents, ambient documentation tools. Most of those deployments are running under borrowed human credentials or generic service accounts. The NIST tenets provide a framework for assessing how far that posture is from "good" — and what closing the gap requires.

Agent Identity Is an Unresolved Gap in Most Healthcare IAM Programs

The June 2026 CSA research note on agentic identity found that 51% of organizations report no clear ownership of AI agent identities, and 16% don't track when new agent identities are created at all. Healthcare organizations face this problem at higher stakes: an agent with access to EHR data, clinical workflows, or HL7/FHIR integration endpoints is a potential HIPAA breach surface, and attributing its actions to "the AI system" rather than to a specific, owned identity with a specific scope is not a posture that survives a breach investigation.

Tenet 1 (Distinct Agent Identification) and Tenet 2 (Delegation and Attenuation) together address this directly. Healthcare security programs building agentic IAM should start here: an inventory of AI agents as named identity principals, with designated owners, defined scopes, and their own credential lifecycles separate from the humans or service accounts they currently borrow from.

Static API Keys and Long-Lived Tokens Are the Norm — and a Direct Target of Tenets 3 and 4

Healthcare integration environments run on long-lived API credentials. EHR vendor integrations, HL7/FHIR broker tokens, HIE connection credentials, and cloud service access keys are routinely issued with multi-year validity and stored in configuration files. When AI agents inherit these credentials — either directly or through service account borrowing — a compromised agent retains access until someone revokes the key manually.

Tenet 4 (Short-Lived, Dynamic, and Revocable Authorization) is a direct challenge to that pattern. The recommended controls — just-in-time tokens scoped to a specific audience, runtime verification at every tool invocation, explicit revocability — require credential infrastructure that most healthcare organizations don't have in place for agentic workloads. This isn't a reason to avoid the framework; it's a gap assessment that security teams can take into their AI governance programs now, before a Special Publication formalizes it as a conformity criterion.

Tenet 7 Has Implications for AI Governance Procurement Language

The statement that guardrails alone are insufficient is not a caveat — it's a design requirement with procurement implications. Healthcare organizations evaluating AI vendors who position model-level safety training, fine-tuning, or system-prompt-based restrictions as their primary security control are receiving an answer that NIST's framework explicitly rejects as insufficient for high-risk agentic deployments.

Translated to vendor assessment: What is the vendor's story for Tenet 7? Is access enforcement architecturally separate from the model? Can the agent be manipulated through its inputs into bypassing that enforcement? If the answer to that last question is "the model is trained not to do that," that is a guardrail, not an architectural control.

Tenet 5 and Consent Fatigue in Clinical Workflows

NIST's flag on consent fatigue in Tenet 5 (Human-in-the-Loop Triggers) maps directly to a known failure mode in clinical workflows. Clinicians are already overloaded with alert fatigue from EHR safety alerts. An agentic AI system that routes every uncertain action to a human approval prompt will either be bypassed or will produce approvals that are functionally automatic. The design implication — that escalation must be rare enough to get real scrutiny — means healthcare organizations need to invest in risk threshold design, not just in adding a human approval step.

Tenet 10 and Audit Log Integrity Under HIPAA

The HIPAA Security Rule (45 CFR § 164.312(b)) requires audit controls that record and examine activity in information systems containing ePHI. Tenet 10 (Immutable Evidence) is a natural extension of that requirement into the agentic layer: the audit trail for an AI agent's actions — what identity it held, what it was authorized to do, what it actually did — must be tamper-evident and held independently of the agent itself. Healthcare organizations that treat agent actions as covered by existing application-layer audit logs should assess whether those logs satisfy the independence requirement.

Where This Goes

The 10 tenets are described as an "initial set," and NIST is explicit that iteration is expected. The NCCoE's upcoming technology demonstrations will test how these tenets can be implemented using existing standards — OAuth 2.0, SPIFFE, WIMSE, Rich Authorization Requests, Transaction Tokens. Those demonstrations will produce practical reference architectures, and they will form the basis for the forthcoming Special Publication that formalizes conformity criteria.

The timeline from voluntary tenets to procurement language is not long. Techjacksolutions.com pegged federal procurement language incorporating cryptographic agent identity requirements at 6–18 months post-publication. For healthcare organizations under existing NIST alignment (most large health systems and any organization in a federal-contract supply chain), the gap between current agentic IAM posture and the NIST tenets is already a risk item, even before the Special Publication publishes.

The practical starting point is an honest baseline: inventory your AI agents as identities, map who owns them, document what credentials they carry and how long those credentials live, and assess whether access enforcement for high-risk agentic transactions depends on the model's behavior or on controls that exist outside it. That gap assessment — run against the 10 tenets — is both the right security investment and the right preparatory work for what's coming.

This is an entry in the AI Security series. For related coverage, see Claude Code's "Don't Ask Again" File Is Leaking Credentials to GitHub and GPT-6 Cyber Is Here — And OpenAI Called It Critical.