What NIST is saying about AI agent security, and what to do before it lands

Standards bodies are catching up with AI agents: software that plans and takes actions with tools, rather than only answering questions. The US National Institute of Standards and Technology has been one of the most active. It asked industry how agents should be secured, published a summary of what it heard, and is writing control overlays that map agent risks onto its existing security controls. None of this is mandatory for most organisations, but NIST guidance tends to become the reference point auditors and customers use. This article summarises where the work stands.

The context: two pieces of work

The request for information. NIST asked for input on security considerations for AI agents and, on 18 May 2026, published a summary analysis of the responses. It groups what respondents raised about how agents should be identified, what they should be allowed to do, how their actions can be monitored, and how existing security practice applies.

COSAiS. The Control Overlays for Securing AI Systems project is building overlays for SP 800-53, NIST's catalogue of security controls. An overlay tailors existing controls to a specific use. The project's use cases include single-agent and multi-agent AI systems, alongside generative AI and predictive AI.

The recurring themes

Read together, the two efforts point to a few recurring areas (our reading, not a NIST list):

• Agent identity. Agents need their own identities, distinct from the people who start them, so their actions can be attributed and limited.
• Least privilege. Agents should get only the tools, data and permissions their task needs, ideally for a limited time.
• Human oversight. Consequential actions should be checked by a person, and the point at which that happens should be designed, not left to chance.
• Monitoring and logging. Organisations need records of what agents did, with which tools, on whose behalf.
• Untrusted input. Agents read content that may contain instructions, so controls can't rely on the model refusing them.

Analysis: what to make of it

It is the existing playbook, applied to agents. Using SP 800-53 as the base is a signal: NIST isn't creating a separate discipline for agents. Access control, audit logging and configuration management still apply, with agents as a new kind of actor.

Identity is the hardest part in practice. Most coding agents today act with the developer's own credentials. Separating agent identity from the person's is easy to recommend and hard to do with current tools.

Status matters. The summary reports what respondents said; it is not guidance. The overlays are in development. Organisations should follow the direction without treating draft material as a requirement.

Monitoring is the most achievable step. Unlike identity, logging what agents do can be done today with the telemetry most tools already emit.

What it means for engineering and security leaders

If you are asked how you secure AI agents, NIST's themes give you a structure for the answer: who the agent is, what it can reach, who approves what, and what is recorded. Mapping your current practice to those questions now will make the eventual overlays easier to adopt.

For AI coding tools specifically, the gaps are usually in least privilege, since agents inherit the developer's access, and in records of tool calls and MCP usage.

Practical takeaways for this week

• Map your AI coding tools and agents to four questions: identity, permissions, approval points and logging.
• Give automated agents, such as review bots, their own service credentials rather than a person's.
• Limit which MCP servers and tools agents can use, and review the list.
• Make sure tool calls and MCP calls are logged centrally, not only on each laptop.
• Follow the COSAiS project page for draft overlays and comment periods.

Where SpanDock fits

On the Enterprise plan, SpanDock guardrails check the prompt and every tool call in Claude Code, Codex and Gemini CLI before it runs, and can block, warn, ask the person to confirm, or redact; every match is recorded. On Premium and up, the MCP gateway gives each person only the connectors and tools they're allowed, and records every call with the person and computer.