standard
US federal security and privacy control catalogue; the essay cites the AU-2 through AU-12 audit and accountability controls as not covering AI coding sessions.
No evidence-backed relationships are recorded.
NIST and CISA have finalized IR 8587, guidance that spells out how signing keys, token verification and revocation are supposed to be handled in cloud identity systems.
Perspective Coverage
4 publishersReality
The FBI published version 6.1 on June 25, 2026, keeping v6.0's NIST-aligned structure while lifting SC-13 and SC-28 to a 256-bit minimum and tripling how often agencies must run vulnerability scans.
Reality
NIST and CISA have finalised implementation guidance for the identity tokens behind single sign-on, written for federal agencies and their cloud providers. The case the announcement rests on is one cited attack.
Reality
Pulumi's research preview builds a threat model before it looks for anything, then leans on two inputs its own post treats as conditional, the infrastructure code behind a resource and the runtime telemetry around it.
Reality
An essay on dev.to argues ISO 27001, SOC 2 and NIST SP 800-53 were built around authenticated human decisions with a paper trail. AI sessions leave none, and you cannot reconstruct them later.
Reality