- Platform
- Know Your Agent
- NIST alignment
NIST and AI agent identity
Agent identity the way NIST is framing it.
NIST’s National Cybersecurity Center of Excellence is working out how identity standards should apply to AI agents: identify them, authenticate them, authorize them, tie them to the people they act for, and log what they do. Know Your Agent does each of these today, on open standards that appear in NIST’s own review.
How each area maps is set out below, including where Know Your Agent stops.
Where NIST is now
A project, not yet a standard.
There’s no NIST standard or certification for AI agent identity yet. NIST is building one practice guide at a time, starting from the identity standards organizations already run.
- February 5, 2026Concept paper
The NCCoE proposes applying existing identity standards to software and AI agents, and asks for comments.
- April 2, 2026Comments close
More than 600 responses arrive, most of them from industry.
- September 29, 2026Summary of comments
Commenters favor building on existing standards, and flag consumer-owned agents as a gap.
- NextDraft project description
Scope, use cases, architecture and standards, published for feedback.
- ThenSP 1800 practice guide
Example builds released in stages, starting with agents in software development.
The mapping
NIST’s questions, and how we answer them.
The concept paper asks how agents should be identified, authenticated, authorized, delegated to, audited and protected from manipulation. Here’s what Know Your Agent does for each, and where it stops.
| NIST asks | How Know Your Agent answers | Where |
|---|---|---|
| IdentificationHow can access systems tell agents from people, and what identifies an agent? | Detect classifies every session as human, AI agent, bot or incomplete data, with a confidence score from 0 to 100, based on behavior rather than what the agent claims. Agents that identify themselves carry a stable, verifiable decentralized identifier (DID) across sessions and services, and KnowThat.ai shows an agent’s vendor and reputation. | |
| AuthenticationWhat counts as strong authentication for an agent, and how are its keys managed? | Agents prove who they are cryptographically, with signed HTTP message signatures or KYA-OS identities. Each request carries a proof signed by the agent, naming the intended audience and a one-time nonce, so a captured proof can’t be reused elsewhere. | |
| AuthorizationHow do zero trust and least privilege apply when an agent’s actions aren’t predictable? | Nothing is trusted by default. Middleware verifies the proof on every request before it reaches your handler, including the scopes that endpoint or tool needs, so an agent can hold files:read without payment:create. Enforce compiles plain-language rules to Cedar policies that allow, challenge, block or redirect, and you can dry-run them on real traffic first. | |
| DelegationHow does an agent act “on behalf of” a person, bound to that person’s identity? | A person grants the agent a delegation through consent, OAuth sign-in or your own identity provider, with scopes, a time limit and constraints, issued as an Ed25519-signed W3C verifiable credential. When that person is verified with Vouched Verify, the agent is tied to a real, identity-proofed human, and you can require their explicit approval before it makes a binding commitment. | |
| Auditing and non-repudiationHow are agent actions logged and traced back to the human who authorized them? | Every proof references the delegation behind it, so each action traces to the agent and to the person who authorized it. Delegations and proofs are logged in the dashboard for review, and you can revoke a delegation there at any time. | |
| Prompt injectionWhat limits the damage when an agent is manipulated? | Know Your Agent doesn’t filter prompts. It keeps authorization outside the model, so a manipulated agent still can’t exceed its scopes, outlast its time limit or act after you revoke it. Pair it with the guardrails on your models. |
Questions paraphrased from NIST’s Accelerating the Adoption of Software and AI Agent Identity and Authorization concept paper, February 2026.
Check our work
Ten tenets, each traceable to the spec.
Every row points to the section of the KYA-OS spec or the Know Your Agent feature where you can verify it yourself.
| # | NIST tenet | How KYA meets it | Where to check |
|---|---|---|---|
| 01 | Distinct agent identification | Each agent holds its own DID and Ed25519 key, generated locally, and is typed as an agent, never a human or a client. | Spec §4 · Entity Card §3 |
| 02 | Linking, delegation and attenuation | A signed delegation chain links every agent to an accountable Responsible Party. Each hop can only narrow scope. | Spec §6.4, §11.4 |
| 03 | Least and zero standing privilege | Identity grants nothing. Authority exists only in task-scoped delegations that name the exact resource. | Spec §6.4.1, §11.0 |
| 04 | Short-lived, dynamic and revocable authorization | Expiring, audience-bound delegations checked on every call with a per-request key proof. Revocation cascades downstream. | Spec §6.5, §11.6 · Entity Card §8 |
| 05 | Human-in-the-loop triggers | Risk-classified step-up that needs N-of-M signed approvals bound to the exact request. | @kya-os/mcp policy gate |
| 06 | Mandates and constraints | The delegation credential is a signed mandate: scopes, audience, time window and budget caps any service can verify. | Spec §6.2, §6.3 |
| 07 | Separation of policy from reasoning | Verification runs at the server or edge, outside the agent. The agent cannot mint or widen its own authority. | Spec §11.0 · KYA Gateway |
| 08 | Deterministic access decisions | Signature, chain and scope checks plus Cedar policy decide. Reputation and detection scores inform, never decide alone. | Spec §6.8 · KYA policies |
| 09 | Continuous monitoring | KYA classifies every request in real time. Every allow, deny and step-up leaves a signed outcome. | KYA · Spec §7.2 |
| 10 | Immutable evidence | A server-signed proof per tool call, kept in an append-only, Merkle-checkpointed log with independent observers. | Spec §7, §15.3 |
Open standards
Built on the standards in NIST’s review.
NIST plans to build on existing identity standards rather than start again, and most commenters agreed. Know Your Agent takes the same approach.
Model Context Protocol
MCP defines how agents reach tools and data, but not who the agent is. KYA-OS adds that identity, and you can add it to an existing MCP server without rewriting it.
OAuth 2.0
People can approve an agent by signing in with providers such as GitHub, Google or Microsoft. A delegation works much like an OAuth token, made for an agent.
NIST SP 800-63A IAL2
Vouched Verify holds Kantara Initiative approval at Identity Assurance Level 2, for proofing the person an agent acts for.
W3C credentials and DIDs
Agents carry decentralized identifiers, and delegations are Ed25519-signed W3C VC-JWTs (VC Data Model 1.1) that anyone can verify independently.
Cedar
NIST’s summary lists Cedar for fine-grained access control. Enforce compiles the rules you write in plain language to Cedar policies.
DIF Trusted AI Agents
NIST’s summary lists this Decentralized Identity Foundation work under delegation. It’s home to KYA-OS, the standard Vouched authored and donated, released as v1.0.0 in July 2026.
Read the spec →NIST names standards and technologies to describe the problem, not to endorse products. Sources: the concept paper and NIST’s summary of comments.
What comes next
NIST’s second phase is where we already work.
NIST’s first build covers agents inside the enterprise. Consumer-owned agents come next, after many commenters called them as important, or more.
Agents your organization runs.
The first use case is AI agents in software development, built with the NCCoE’s DevSecOps project. Govern fits here today: agents calling your APIs and MCP servers present a proof and a delegation on every request.
Explore GovernAgents your customers bring.
Commenters warned that consumer services can’t yet tell a person from an agent, especially when the agent signs in with the person’s credentials. Detect and Enforce do that on your website and APIs today.
Explore DetectFAQ
NIST and AI agents, answered.
What NIST has published, what it hasn’t, and where Know Your Agent fits.
Contact us with a questionIs Know Your Agent NIST certified?
No NIST certification exists for AI agent identity. The NCCoE is still defining its project, and the deliverable it plans is a practice guide with example implementations, not a certification. This page maps Know Your Agent to the questions in NIST’s concept paper. Separately, Vouched Verify holds Kantara Initiative approval for NIST SP 800-63A IAL2, which covers proofing people.
What is the NIST project on AI agent identity?
In February 2026, NIST’s National Cybersecurity Center of Excellence published a concept paper, Accelerating the Adoption of Software and AI Agent Identity and Authorization. It proposes showing how existing identity standards, such as OAuth and OpenID Connect, apply to AI agents, and it asked for public comment through April 2, 2026.
When will NIST publish guidance?
NIST published its summary of comments on September 29, 2026. Its next step is a draft project description, followed by an SP 1800 practice guide released in stages. NIST hasn’t given dates for either.
Does NIST’s project cover agents that visit my website?
Not at first. The first phase covers agents inside the enterprise, starting with software development. NIST says a later phase will cover consumer-owned agents, which is what Detect and Enforce handle on websites and APIs today.
Does Know Your Agent prevent prompt injection?
No. It limits what a manipulated agent can do. Authorization happens outside the model, on every request, so an agent can’t exceed its scopes, outlast its time limit or act after its delegation is revoked. Use it alongside the guardrails on your models.
Can you walk through this mapping with my team?
Yes. Talk to sales and we’ll walk your security and compliance team through it, using your own agent traffic and policies.