Source author: Bill Fisher, NISTWhat NIST published in August
On 27 August 2026, NIST's Bill Fisher and Ryan Galluzzo published a discussion of identity and access management for agentic AI. It warns against credential sharing, static tokens, broad permissions and excessive approval prompts. This is guidance and ongoing standards work, not a product certification or a new legal obligation.
The question to ask before connecting a tool
Our practical recommendation: write down the agent's owner, the task it is allowed to perform, the records it can read, the actions it cannot take and the point at which its access expires. Keep the agent distinguishable from the person who requested the task. Otherwise, an investigation may show an employee account acting without explaining which automated workflow caused the action.
A simple review for a support assistant
Consider a synthetic example: an assistant summarises a support case. It needs the case description, but may not need a full phone number, payment details or every case in the account. Start with a narrow read permission. Remove unnecessary identifiers before the configured model call. Require a separate decision before revealing protected values or taking a consequential action. These are design questions to test, not a story about a customer deployment.
Test the refusal as carefully as the success
Try a different customer record, an expired grant and a tool action outside the agreed task. Verify that the relevant service refuses them. Then check which identity, scope, outcome and request identifier remain in the evidence. Do not copy the credential or sensitive payload into the audit log. A useful review covers retries and revoked access, not only a successful demonstration.
Where Securelay fits
Securelay can support configured privacy and access decisions on connected data routes, protected references and value-free audit records. The surrounding system still needs workload identity, tool permissions and controls over routes outside Securelay. Start with one workflow and agree which decisions each component must enforce.