NIST narrows agentic AI scope to DevSecOps, consumer agents

NIST's National Cybersecurity Center of Excellence is narrowing a research project, and that matters for anyone tracking agentic AI guidance. A Sept. 29 summary says the center's identity and authorization effort will proceed with two use cases after a Feb. 5 concept paper drew more than 600 comments from industry, government, and academia.

The first phase applies agentic AI inside an enterprise software factory, through an existing NIST cooperative research and development agreement for DevSecOps, to show how agents can be deployed and secured within the software development lifecycle. The second phase shifts to consumer-owned or controlled agents and the security controls and best practices around them. NIST also launched a blog series in August reviewing comment themes, beginning with credential sharing and human-in-the-loop controls.

The next concrete deliverable is a draft project description asking for feedback on proposed scope, use cases, architecture, and standards. That draft has no release date in the summary, which is the gap worth noting. After 600-plus comments, the plan is more consultation, with an online resource hub set up to publish deliverables on agentic identity and authorization. Nothing changes Monday for a security engineer, except the scope of what to watch.