NIST traces the agent accountability gap to users handing over their own credentials

A shared credential leaves one identity in the record for two actors, which is the accountability gap NIST describes: identity management works by verifying both the identity and the permissions of whoever is attempting a transaction ^[3]. The post names financial transactions and the sharing of health information as the places where that gap becomes a security, privacy or legal problem, because those sectors treat non-repudiation as a core security feature ^[4].

Its diagnosis of the cause is ordinary. Early agentic deployments are prioritizing feature development and immediate value over security ^[1], and NIST adds that "model-only" guardrails are not yet fully equipped to solve the new class of problems agents bring ^[14].

For enterprises, the post argues that agentic AI has not outrun its authorization protocols. It states that many agentic use cases can be handled by existing modern authorization patterns already used for delegating access to digital tools ^[6], and it points implementers at SPIFFE and OAuth 2.0 ^[7]. Two further specifications, Workload Identity in Multi-System Environments and the Identity Assertion JWT Authorization Grant, are described as emerging work built on those protocols ^[8]. Of the four protocols named for enterprise deployments, two are presented as available mechanisms and two as unfinished ^[16].

What NIST asks operators to deploy instead is first-class identity for the agent: its own unique identifier, credentials and entitlements, bound to and by the identity of the user or system operating it ^[5]. Enterprises and IAM vendors are already aligned on that, with vendors building agent identity registries, rights delegation and policy management ^[19].

The post draws on public comments on the NCCoE concept paper on accelerating the adoption of software and AI agent identity and authorization, plus engagement with stakeholders in the agentic ecosystem ^[9]. That evidence is qualitative, not quantitative. Its strongest prevalence statement is that giving agents personal and enterprise credentials has quickly become a common pattern ^[2], and no count sits behind that phrase ^[18]. The post gives no figure for what share of live deployments pass a human credential to an agent, and no comparison of incident rates between deployments that use delegation and those that do not.

The consumer half is where NIST concedes the tooling is thin. A company serving consumers has little to no control over the agent's identity and may struggle to tell an agent from a human, and when the user has shared credentials the agent can impersonate that user ^[11]. FIDO is looking at ways to issue agent authenticators that can be bound to user identities, and the post says that work is still in early phases ^[12]. For consumer scenarios, it adds, the "secure path" will also need to be the "easy path" ^[13].