Comment on NCCoE AI Agent Identity and Authorization

This comment extends our March 6, 2026 CAISI submission into the identity and authorization domain: an AI agent's identity is incomplete without its verified behavioral safety posture, and authorization to act in sensitive contexts should require behavioral safety certification.

The NCCoE concept paper correctly identifies that organizations need to understand how identification, authentication, and authorization apply to AI agents. It proposes a practical demonstration project anchored in existing standards — OAuth 2.0/2.1, OpenID Connect, SPIFFE/SPIRE, SCIM, and NGAC. These are necessary infrastructure components. But they address only one dimension of the trust problem: can this agent prove it is who it claims to be, and does it have permission to access this resource?

A second dimension is missing: has this agent been independently verified to behave safely within the scope of its authorization?

An agent can be cryptographically authenticated, operating within its OAuth-delegated scope, and still cause harm through behavioral patterns that no access control would prevent. The concept paper's framing assumes that if we solve identification, authentication, and authorization at the infrastructure level, agents will be trustworthy. The judicial and actuarial record of 2025–2026 demonstrates otherwise.

In Garcia v. Character Technologies, Inc., the court found design defects not in an agent's technical capabilities but in its behavioral parameters — absence of crisis escalation, anthropomorphic manipulation, and engagement-maximizing design. These are behavioral failures that no OAuth scope or SPIFFE identity could prevent.

The core characteristics that make agentic architectures distinct from prior automation are: (1) non-deterministic reasoning — the same input may produce different outputs; (2) dynamic tool selection — agents choose which tools to invoke at runtime; (3) persistent state accumulation across interactions; and (4) unbounded action spaces that cannot be fully enumerated at deployment time.

Traditional authorization assumes a bounded action space. Agentic systems have an unbounded action space constrained only by their behavioral parameters. Authorization policies must therefore incorporate verified behavioral constraints — not just resource access permissions — to meaningfully limit risk.

We propose that NIST integrate behavioral safety credentialing as a component of agent identity metadata, as an input to authorization policy decisions, and as a dimension of audit and non-repudiation.

Specifically, we propose a fourth use case for the NCCoE demonstration project: behavioral safety credentialing as an authorization gate for agent deployment. Using W3C Verifiable Credentials, a behavioral safety credential issued by a certified auditor could be embedded in an agent's identity profile, presented during authorization flows, and verified by relying parties — including insurers — without requiring direct access to the agent's internal architecture.

1. Integrate behavioral safety as a component of agent identity metadata within the NCCoE demonstration project.

2. Include behavioral safety credentialing as a fourth demonstration use case alongside the three proposed in the concept paper.

3. Extend SP 800-63-4's identity assurance levels to inform a parallel framework for behavioral safety assurance levels.

4. Adopt W3C Verifiable Credentials as the mechanism for expressing behavioral safety certifications within agent identity profiles.