Most teams deploying autonomous agents reach for the same answer when asked how they govern them: “we issue an API key and log the requests.” That answer survives exactly until the first security questionnaire, the first auditor, or the first agent that does something nobody approved.
There is a better frame, and it is not vendor-specific. The US National Institute of Standards and Technology, through its National Cybersecurity Center of Excellence, describes machine and non-human identity around four pillars. They map almost perfectly onto what an AI agent needs.
Pillar 1 — Identification
The question is simple: can you prove which agent did something, beyond doubt?
An API key identifies a service, not an instance. It can be copied, shared between agents, and rotated without a trace. When a regulator asks “which agent moved that money?”, a shared key cannot answer.
Identification means every agent instance carries a forgery-proof identity. In practice that means an X.509 certificate issued by a KMS-backed certificate authority, with the model hash pinned inside the certificate. The private key never leaves secure hardware. The identity is per-instance and non-repudiable.
Pillar 2 — Authorization
Identity without authorization is a name tag with no boundaries. Authorization means the agent’s scope — maximum transaction size, allowed instruments, counterparties, or operating hours — is bound to the identity and enforced before the action runs, not checked optimistically afterward.
The harder version of this problem is delegation. When an agent spawns a sub-agent, who actually authorized the sub-agent? The modern answer is an explicit delegation chain that preserves the human → agent → sub-agent line of authority.
Pillar 3 — Auditing
Auditing is more than a log file. It means every action is scored against the agent’s own behavioral baseline so gradual drift is caught, not only dramatic spikes. It also means watching what the agent says, not only what it does.
Good auditing links related events into a single causal unit so an investigator reconstructs one incident instead of grepping a thousand rows. And it lets you export that history with a signed, tamper-evident proof that the record was not altered.
Pillar 4 — Non-repudiation
Non-repudiation turns claims into evidence. Signed actions, signed kill-switch receipts, and a write-once-read-many audit log mean every action carries proof of authorship.
This is the difference between telling a regulator “our logs say the agent did X” and handing them a record they can verify themselves without trusting you.
Why the four-pillar frame travels
The reason to anchor on NIST’s pillars rather than a specific regulation is simple: regulations vary by region and slip by years; the pillars do not. Build to identification, authorization, auditing, and non-repudiation, and you can render the same controls to whichever regime asks.
A certificate proves who. The four pillars, implemented together, prove what happened, under whose authority, and verifiably so. That is the bar for governing an agent you let act on its own.