The Agent-Standards Bodies Are Converging on the Properties You Should Already Build

Three agent-standards documents landed in ten weeks, and all three point at the same control surface. OWASP published its Top 10 for Agentic Applications 2026 on December 9, 2025 (57 pages, 100+ contributors). The Cloud Security Alliance published the Agentic Trust Framework on February 2, 2026. NIST's Center for AI Standards and Innovation announced the AI Agent Standards Initiative on February 17, 2026.

The rest of the "Mapping to Frameworks" subsection maps systems to controls that already exist. Three bodies, working independently, converged on the surface this handbook calls the seven properties: agent identity bound to a human, attribution of every action, and logging an auditor can trust. None of the three is enforceable control language today. The standards are in motion, and they are moving toward the bar the environment design and the work model are already built to.

NIST's open questions are this handbook's checklist

NIST's initiative shipped with two concrete artifacts: a CAISI Request for Information on AI Agent Security (responses due March 9, 2026) and an NCCoE draft concept paper on software and AI agent identity and authorization (comments due April 2, 2026). There is no draft control language from the initiative itself; the concept paper is pre-project scoping.

The scoping questions are the tell. NCCoE's reviewer questions ask how to bind agent identity to human identity for human-in-the-loop authorization, how to achieve tamper-proof, verifiable logging of actions and intent, and how to get non-repudiation binding back to human authorization. Those three questions are attribution and the audit trail, restated in standards language. And one of the paper's three candidate use cases is "agents in software development and deployment pipelines": the exact system this handbook describes.

The candidate building blocks are existing identity standards, not new inventions: OAuth 2.0/2.1 and OIDC, SPIFFE/SPIRE for workload identity, SCIM for agent identity lifecycle, MCP's OAuth-based authorization, anchored to SP 800-207 (Zero Trust) and SP 800-63-4 (Digital Identity). The desired outcome is an NCCoE practice guide with lab-built example implementations. One thing secondary coverage gets wrong, worth flagging since the framework-mapping index routes the NIST AI RMF questionnaire to this page: the initiative sits under CAISI and ITL standards work, and none of the three primary documents links it to the AI RMF. Sources that frame it as an AI RMF extension are editorializing.

CSA wrote requirement names for attribution

The Agentic Trust Framework is an open CC BY 4.0 spec applying Zero Trust to agents. Attribution detail worth keeping straight: it was authored by Josh Woodruff of MassiveScale.AI, a CSA Research Fellow, and published on CSA's blog; stewardship formally transferred to CSA's new CSAI Foundation on April 29, 2026, alongside CSA's acquisition of Vanta's AARM and its authorization as a CVE Numbering Authority.

ATF's identity element requires a unique immutable identifier per agent instance, credential binding, and an ownership chain. Its behavior element requires action attribution: "every action tied to agent identity and session context." Its incident-response element requires a kill switch with under 1 second manual termination. The framework's core principle is that autonomy is earned, not granted: a four-level maturity model (Intern through Principal) with minimum dwell times, five promotion gates, and automatic demotion on any significant incident. It also ships an illustrative mapping table to SOC 2, ISO 27001, NIST AI RMF, and EU AI Act articles, with the caveat that the EU AI Act does not explicitly address agentic systems, so those mappings are interpretive.

OWASP named the identity mismatch as a root cause

The OWASP list introduces a new ID scheme, ASI01 through ASI10, distinct from the LLM Top 10, because agents add tool use, multi-step reasoning, and inter-agent communication that the LLM list covers incompletely. ASI03, Identity and Privilege Abuse, names its root cause as "the architectural mismatch between user-centric identity systems and agentic design": agents lacking a distinct, governed identity of their own. That is the borrowed-token problem, the laptop model's identity collapse, stated as a top-ten risk class. ASI09, Human-Agent Trust Exploitation, covers the agent manipulating a human into performing the final audited action, hiding the agent's role from forensics, which is precisely why human-authored and AI-authored must stay distinguishable in the record. The full taxonomy is covered in OWASP for agents.

Nothing here is binding yet, and that cuts both ways

NIST has an RFI and a concept paper, not controls; deliverables are promised "in the months ahead," with sector listening sessions (healthcare, finance, education) starting April 2026. ATF is an open spec a CSA foundation now stewards, not an auditable certification. OWASP's list is a risk taxonomy, not a control framework. The field is silent, so far, on how any of this becomes an audit criterion with a test procedure attached.

That is not a reason to wait. The convergence tells you where the eventual control language will point: distinct agent identity, binding to an accountable human, non-repudiation, tamper-proof logs. A system with the seven properties already produces that evidence as a byproduct, because the environment and the work model emit it on every action. A team that never bound the agent to a responsible human will be retrofitting identity infrastructure under a comment deadline.