New federal guidance on protecting digital identity tokens leaves a critical gap: it doesn't address the authorization risks posed by AI agents operating inside enterprise systems. "Protecting Tokens and Assertions from Forgery, Theft, and Misuse," published by the National Institute of Standards and Technology (NIST) with assistance from the Cybersecurity and Infrastructure Security Agency (CISA), offers recommendations for operators of systems that rely on digitally signed tokens to control access, including single sign-on and API access. The report, also designated NIST IR 8587, centers on what occurs after authentication: tokens and assertions can transport proof of authentication or authorization between systems, enabling an attacker who steals them to abuse access that's already been granted.
NIST advises applying identical safeguards to signed tokens used by AI agents as those used by humans, but acknowledges that access risks created by AI and AI agents "create additional IAM challenges that require further guidelines and, in some cases, new or expanded standards and protocols." The agency recommends continuous monitoring alongside stricter controls across the entire token lifecycle. The issue carries particular weight for CISA following an incident in May, when a public GitHub repository thought to be maintained by a CISA contractor was discovered containing sensitive government credentials, including AWS tokens and GitHub access tokens. IR 8587 focuses on asymmetrically signed tokens and explicitly excludes mechanisms such as API keys from the scope of its controls.
According to the report, a frequent vulnerability is assuming that because a token is valid, the activity linked to it is legitimate. Organizations should weigh the context in which a token is presented, including whether a user is accessing sensitive systems from an unusual location or at an unexpected time. The report points organizations toward shared-signal mechanisms such as the Continuous Access Evaluation Profile (CAEP) and Risk Incident Sharing and Coordination (RISC), which can help connected systems respond when token-related security conditions change. NIST requires covered tokens to be kept out of logs, CI/CD pipelines, and build artifacts.
The challenge with AI agents runs deeper than token validation. An agent may act on behalf of a user, invoke a tool, and then reach another service, making it increasingly difficult to determine whose authority is being exercised as the chain lengthens. Prompt injection could also steer an agent holding a valid token toward an action the user never requested, and token verification wouldn't necessarily catch that misuse because the token itself could still be legitimate. Delegation can make that boundary harder to establish. Managing the lifecycle of an agent's identity is part of the problem: enterprises need visibility into who provisioned an agent's credentials and what those credentials allow, and access should also be withdrawn when the agent's task ends. Token hardening assumes the token holder is a known, bounded actor, but an agentic system breaks that assumption.
The report's recommendations can reduce both the duration and reach of a token compromise. Audience restrictions can limit where a stolen token is accepted, while cryptographically binding a token to the client holding the corresponding private key makes replay by an attacker more difficult. Other controls can limit the usefulness of a compromised token when revocation isn't possible due to architectural limitations. Enterprises should eliminate static tokens wherever feasible and replace them with short-lived credentials, particularly in DevOps environments where credentials can be copied onto developer machines or exposed through automated pipelines. CISOs should treat AI agents as low-trust non-human identities, granting only the access required for a task, and higher-risk actions should require human approval. Maintaining an agent inventory and keeping those identities separate from human accounts, with credentials that expire when the task is complete, offers a practical path forward until NIST and CISA finish developing specific guidelines for agentic systems. The tension between velocity and control will only sharpen as organizations deploy agents more widely without clear regulatory frameworks to match their evolving capabilities.