Can existing identity standards work for AI agents?

NIST's National Cybersecurity Center of Excellence (NCCoE) argues, in a February 2026 concept paper seeking public comment, that the identity problem for AI agents should be solved by applying standards that already exist rather than inventing new ones. The paper states the project "is currently considering the implementation of the following standards and best practices": the Model Context Protocol (MCP), OAuth 2.0/2.1, OpenID Connect (OIDC), and SPIFFE/SPIRE, plus NIST's own guidelines (SP 800-207 Zero Trust Architecture, SP 800-63-4 Digital Identity Guidelines, NISTIR 8587). It frames the challenge as applying "foundational identity principles—identification, authentication, and authorization" to agents, "systems that have the capability for autonomous decision-making and taking action with limited human supervision," so that organizations can "ensure that agents are known, trusted, and properly governed."

The paper organizes this into five "areas of interest": identification (distinguishing agent from human identities), authorization (using OAuth and policy-based access control to grant and enforce rights), access delegation ("link specific user identities to AI agents... to support effective delegation controls and maintain accountability"), logging and transparency (tying actions to the non-human identity that performed them), and data flow tracking (provenance of prompts and inputs). Notably, the paper observes that MCP "relies on existing identity standards such as Open Authorization (OAuth) and Open ID Connect (OIDC) for rights delegation and authentication," and that OAuth is "integrated into the MCP as the primary method for authorizing agentic access" — the agentic protocol layer is already built on top of these human-identity standards, not a clean slate.

This gives concrete technical shape to the standardization gap that Why do agents fail at identity verification and authorization? names from the red-teaming side: where that note's NIST initiative flags identity and authorization as priority areas in the abstract, this concept paper specifies which existing standards (OAuth, OIDC, SPIFFE/SPIRE) NIST intends to test against agentic architectures, and proposes SPIFFE/SPIRE specifically as a mechanism for issuing agents cryptographic workload identities — a candidate fix for the very gap that How vulnerable are deployed AI agents to poisoning attacks? measures empirically, where identity is one of the three poisoned dimensions. The "Access Delegation" area also names the same accountability problem that What makes delegation work beyond just splitting tasks? treats as a design-axis problem: NIST's framing is about linking a delegated agent back to an accountable user identity, which is a narrower, protocol-level slice of the broader delegation-contract problem. Within How do agent security layers connect across the stack?, NIST's five areas map onto the identity and delegation layers of that stack specifically, not the full set of layers the survey describes (inputs, routing, containment, governance).

The paper is explicit about what it does not cover: it scopes itself to "enterprise use-cases where greater control and visibility can be maintained over agents and the systems they access," and states that "the challenge of identifying and managing access for external agents from untrusted sources will not be addressed under this initial effort." It is also a concept paper soliciting "stakeholder input," not a finished standard, demonstrated implementation, or adopted practice guide — NIST describes the eventual deliverable (a practice guide "built in the NCCoE laboratories using commercially available technologies") as a future outcome contingent on community feedback. The implication is bounded: existing identity infrastructure may transfer to agent identity within controlled enterprise perimeters, but the paper itself does not claim a solution to agent identity verification across untrusted, open, or adversarial boundaries — the harder case that agent-to-agent and public-facing deployments raise.