614 Comments to NIST Agreed: Don't Let the Agent Approve Its Own Actions

In February, NIST's National Cybersecurity Center of Excellence (NCCoE) asked how organizations should secure identity and authorization for AI agents. It received 614 responses, 70% of them from industry. The Summary of Comments is now public, and it is the clearest view yet of what practitioners think good agent governance requires.

For a CISO, VP, or AI risk officer, the summary answers a practical question: what will a defensible agent program be expected to have? For AI architects, it sketches the shape of the system. Below, each quote names the section of the report it comes from.

Where the field agreed

The model does not make the security decision. In Deterministic v. Probabilistic Authorization approaches, NIST reports "very strong opposition to leveraging LLMs and other probabilistic mechanisms as the primary or sole arbiter of authorization decisions", and concludes: "In the end, consensus pointed to deterministic policy and policy enforcement being essential to security, with probabilistic capabilities potentially being layered in to provide context to authorization decisions."

For the business: if a model can be talked into approving an action, your control can be talked out of existence. Your auditors will ask what decided, and "the agent thought it was fine" is not an answer.

Governance runs outside the agent. In Control Plane vs. Data Plane, the report finds "there was consensus that a logically separate agent governance component was essential to securing workflows and effectively managing authorization consistent with Zero Trust principles." Architects should read this as a decision point between the agent and every tool, data source, and other agent it touches.

Authority is checked per task and narrows as work is handed on. In Task Scoped & Contextual Authorization: "Relying on static entitlements or super-sets of inherited entitlements is insufficient to address the probabilistic nature of agents as they decompose and execute the tasks they are assigned." Commenters want authorization evaluated at the task level and narrowed as sub-agents take on chained work. That is least privilege applied at machine speed, and it shrinks what any one compromised agent can do.

Every action traces back to a person. In Delegation and Accountability, NIST records "clear concern that agentic ecosystems could create accountability gaps if downstream actions cannot be reliably connected back through the call chain to the responsible human or institution." When an agent three hops down deletes a record, someone accountable must be identifiable.

The other critical areas

The report goes further, and each area belongs on a risk register:

• Identity that is both stable and short-lived (Persistence and Ephemerality): persistent trust anchors paired with "ephemeral, tightly scoped credentials, entitlements, and authorizations."
• Prompt injection (Direct and Indirect Prompt Injection): authorization policy "should change if a prompt injection is suspected".
• Audit that explains why (Auditability beyond action logging): traditional logs "often fail to capture why an action occurred, what authority governed it, what information influenced the decision".
• Privacy (Privacy): data minimization "cannot be enforced purely by policy mechanisms."
• Approval fatigue (User Experience): commenters recommend reserving human approval "solely for high-impact, high-risk actions."
• Crossing trust boundaries (Feedback on NCCoE Project Scope): "agents must have a way of establishing trust as they cross boundaries."

One framework for all of it

If you want these findings as one framework you can assess against, our 12 Non-Negotiable Principles for Agent Runtime Governance (February 2026) sets out each as a requirement:

NIST finding	12 Principles
Deterministic enforcement decides	P4 Deterministic Control Planes
Separate governance layer, every action evaluated	P4, P7 Runtime Policy Enforcement
Task-scoped, narrowing authority	P3 Authority Is Explicit, Scoped, and Time-Bound
Traceable delegation	P3, P12 Multi-Agent Coordination
Distinct, verifiable agent identity	P1 Agent Identity Is Mandatory
Intent	P2 Explicit Purpose, Goals, and Intent
Audit that explains why	P9 Observability and Auditability
Risk-based human approval	P5 Plan-Act-Observe, P6 Human-in-the-Loop
Revocation and containment	P10 Safe Failure Semantics, P11 Tool and Service Governance

Some areas remain open beyond any one framework: privacy and anonymity for consumer agents, trust between organizations, and a standard way to express intent.

What is still unsettled

NIST is candid about the gaps. On agent identity, "there was no consensus on the exact means for doing this". On intent, "the term “intent” is not fully defined". And for architects weighing protocols, the Relevant Standards section describes MCP and A2A as "fast-moving implementation-layer interoperability protocols, not complete identity or authorization standards." Connecting an agent to tools is not the same as governing what it does with them.

Five questions for your agent program

1. Can a model's output ever approve its own action?
2. Is authority checked when each action runs, or only when the agent is set up?
3. Does authority narrow every time work passes to another agent?
4. Can you trace any action back to the person who authorized it?
5. Do your records show the policy decision and the authority behind it, or only the tool call?

If any answer is "no" or "we're not sure," that is the gap the NIST commenters described.

Watchlight AI Beacon is built to answer all five: deterministic policy decides every action before it runs, sub-agents can only receive narrower authority, high-risk actions wait for human approval, and every decision is recorded in signed execution lineage. If you want to map your own program first, our advisory workshops start there.

Come see it for yourself. Request a demo and watch Agent Runtime Governance authorize, stop, and prove an agent action in real time: watchlight.ai/demo.