Box Commons respectfully submits this comment on the NCCoE Concept Paper, "Accelerating the Adoption of Software and AI Agent Identity and Authorization." We previously submitted a public comment on March 6, 2026 in response to the CAISI Request for Information on Security Considerations for Artificial Intelligence Agents (Docket NIST-2025-0035, Tracking: mmf-286f-aneg), in which we argued that behavioral safety constitutes a distinct and unaddressed security domain. Box Commons is a 501(c)(6) trade association in formation dedicated to AI agent credentialing standards.
This comment extends our March argument into the identity and authorization domain: an AI agent's identity is incomplete without its verified behavioral safety posture, and authorization to act in sensitive contexts should require behavioral safety certification.
The concept paper correctly identifies that organizations need to understand how identification, authentication, and authorization apply to AI agents. It proposes a practical NCCoE demonstration project anchored in existing standards—OAuth 2.0/2.1, OpenID Connect, SPIFFE/SPIRE, SCIM, and NGAC. These are necessary infrastructure components. But they address only one dimension of the trust problem: can this agent prove it is who it claims to be, and does it have permission to access this resource?
A second dimension is missing: has this agent been independently verified to behave safely within the scope of its authorization? An agent that authenticates flawlessly via OAuth, operates within its delegated authority, and logs every action in a tamper-proof audit trail can still cause catastrophic harm if its behavioral parameters permit unsafe interactions.
We propose that NIST integrate behavioral safety credentialing as a component of agent identity metadata, as an input to authorization policy decisions, and as a dimension of audit and non-repudiation. We further propose a fourth use case for the NCCoE demonstration project: behavioral safety credentialing as an authorization gate for agent deployment.
Beyond the three use cases identified in the concept paper (workforce efficiency, security, software development), a critical emerging use case is consumer-facing autonomous agents—AI companions, financial advisors, healthcare navigators, and customer service agents that interact directly with the public, including vulnerable populations. In the near future, enterprises will deploy multi-agent orchestration systems where agents delegate to and coordinate with other agents, autonomous procurement agents that negotiate contracts and authorize purchases, and regulatory compliance agents that interpret and apply complex regulatory frameworks across jurisdictions.
The insurance market is already treating consumer-facing agent deployment as an authorization problem. Armilla AI requires independent third-party verification of model performance, bias assessment, and behavioral robustness before issuing coverage. These insurers are constructing de facto authorization gates: without credentialing, no coverage; without coverage, no commercially viable deployment.
The core characteristics that make agentic architectures distinct from prior automation paradigms are: (1) non-deterministic reasoning—the same input may produce different outputs depending on model state, context, and reasoning chain; (2) dynamic tool selection—agents choose which tools to invoke at runtime rather than following predetermined execution paths; (3) persistent state accumulation—agents build context across interactions through memory and conversation history; and (4) unbounded action spaces—the set of possible agent actions cannot be fully enumerated at deployment time.
The risk that concerns us most is the gap between infrastructure identity and behavioral identity. An agent can be cryptographically authenticated, operating within its OAuth-delegated scope, and still cause harm through behavioral patterns that no access control would prevent.
MCP adoption is accelerating rapidly. MCP's reliance on OAuth and OIDC for authorization is architecturally sound. However, MCP's current specification addresses resource access authorization but does not address behavioral authorization. As MCP becomes the de facto standard for agent-to-resource and agent-to-agent communication, behavioral safety credentials should be expressible within the protocol's authorization framework.
Agentic architectures introduce a challenge the concept paper acknowledges but does not fully develop: the non-deterministic nature of agent actions. The paper asks how to establish "least privilege" for an agent "especially when its required actions might not be fully predictable when deployed." This unpredictability is precisely why behavioral safety credentialing is essential. Authorization policies must incorporate verified behavioral constraints—not just resource access permissions—to meaningfully limit risk.
Box Commons is developing credentialing methodology and assessment frameworks for AI agent behavioral safety. Our technical roadmap includes: (1) a behavioral safety assessment instrument designed for integration with W3C Verifiable Credentials; (2) a certification lifecycle management system for issuing, renewing, and revoking behavioral safety credentials; and (3) integration specifications mapping behavioral safety credentials to OAuth 2.0/2.1, NGAC, and SCIM.
In addition to the standards the concept paper identifies (OAuth 2.0/2.1, OIDC, SPIFFE/SPIRE, SCIM, NGAC), NIST should consider the W3C Verifiable Credentials (VC) standard as a mechanism for expressing behavioral safety certifications within agent identity metadata. Verifiable Credentials provide a cryptographically secure, privacy-preserving, and interoperable format for third-party attestations.
We also note that NIST's own guidelines—SP 800-207 (Zero Trust Architecture), SP 800-63-4 (Digital Identity Guidelines), and NISTIR 8587 (Protecting Tokens and Assertions from Forgery, Theft, and Misuse)—provide foundational frameworks that should be explicitly extended to address behavioral safety credentials as a class of identity assertion.
Agent identity metadata should include, at minimum:
Both. Core identity attributes (model provenance, organizational binding) should be persistent. Behavioral safety credentials should have defined validity periods with mandatory renewal—analogous to SSL certificates. Behavioral drift makes perpetual credentials dangerous.
Agent identities should be bound to the deploying organization and the specific deployment configuration (model version + system prompt + tool access + behavioral safety controls). A change in any of these components should trigger re-identification and potentially re-certification.
Strong authentication for an AI agent should include two dimensions:
Infrastructure authentication without behavioral attestation is analogous to verifying that a driver has a valid license without checking whether they have insurance.
Behavioral safety credentials require a lifecycle management process parallel to cryptographic key management:
Zero-trust principles should extend beyond resource access to behavioral trust. Every authorization decision should incorporate:
Yes, and behavioral safety credentialing provides a principled mechanism. When an agent gains access to new tools, its behavioral attack surface expands. Authorization policies should incorporate behavioral re-certification triggers: when the sensitivity tier of aggregated data exceeds the scope of the agent's current behavioral safety credential, authorization should be suspended pending re-assessment.
Traditional least-privilege models define a static permission set. Agents require a dynamic behavioral envelope: a set of behavioral constraints that limit not just what the agent can access but how it can act within its access scope. Behavioral safety certification verifies that these constraints are implemented and effective.
An agent should prove authority through dual presentation: (1) infrastructure credentials establishing permission, and (2) a behavioral safety credential establishing certification to operate safely. This mirrors how regulated professionals prove authority: a physician presents both a medical license and malpractice insurance.
Delegation should encompass behavioral scope, not just resource scope. A healthcare administrator delegating patient record access to an agent should be able to constrain the agent's behavioral parameters as part of the delegation grant. Behavioral safety certification of the agent should be a prerequisite for accepting delegated authority in sensitive contexts.
Human-in-the-loop authorization should be tiered based on the agent's behavioral safety certification level. Higher-tier certifications should require less frequent human intervention for routine operations, creating a market incentive for developers to pursue and maintain behavioral safety certification.
We propose extending tamper-proof audit logging to behavioral decision logging: every behavioral safety decision the agent makes should be logged with the same guarantees as resource access decisions. This is essential for insurance claims adjudication, regulatory compliance, and post-incident forensics.
Non-repudiation should encompass behavioral attestation: the audit record should cryptographically bind the agent's behavioral safety credential to each logged action. If the credential was expired or revoked at the time of the action, the non-repudiation chain reveals the agent was operating without valid behavioral authorization.
Behavioral safety controls serve as a complementary defense layer. Even if an injection succeeds in bypassing input filtering, architecturally enforced behavioral constraints limit the harm the compromised agent can inflict. This is defense-in-depth applied to behavioral safety.
Post-injection impact mitigation is where behavioral safety certification provides its most distinctive value. Three classes of behavioral controls limit blast radius:
We propose a fourth use case for the NCCoE demonstration project:
Enterprise AI agents with behavioral safety credentialing for insurance-integrated authorization.
The demonstration would show:
Recommendation 1: Include behavioral safety posture in agent identity metadata.
The NCCoE demonstration should define a standard agent identity schema that includes behavioral safety credentials alongside infrastructure identity attributes, using the W3C Verifiable Credentials standard.
Recommendation 2: Incorporate behavioral safety into authorization policy evaluation.
Authorization frameworks (OAuth 2.0/2.1, NGAC) should show how behavioral safety credentials serve as authorization inputs for risk-based, context-sensitive decisions.
Recommendation 3: Define behavioral safety credential lifecycle management.
The NCCoE project should demonstrate issuance, renewal, revocation, and verification of behavioral safety credentials, following NISTIR 8587 guidance.
Recommendation 4: Add a fourth use case for behavioral safety credentialing.
The demonstration project should include a use case showing behavioral safety credentialing as an authorization gate, with insurance underwriting integration.
Recommendation 5: Coordinate with the CAISI RFI work stream.
The identity/authorization and security work streams should produce complementary, non-duplicative guidance.
Recommendation 6: Expand scope to include consumer-facing agents in future iterations.
Consumer-facing agents present the most acute identity and authorization challenges.
Box Commons is a 501(c)(6) trade association in formation, dedicated to developing independent credentialing standards for AI agent behavioral safety. We build the measurement and certification infrastructure that makes trustworthy AI verifiable — technology-agnostic standards, third-party certification, and governance no single company controls.
We submitted a comprehensive public comment on the CAISI RFI (Docket NIST-2025-0035, March 6, 2026) establishing the evidence base for behavioral safety as a security domain. This comment extends that work into the identity and authorization domain.
Respectfully submitted,
Brice Love, Acting Executive Director
Box Commons
[email protected]
The paper addresses whether an agent can prove who it is and what it can access, but not whether the agent has been independently verified to behave safely.
Zero-trust principles should extend beyond resource access to behavioral trust. Every authorization decision should incorporate both resource access authorization and behavioral authorization through verified credentials.
Enterprise AI agents with behavioral safety credentialing for insurance-integrated authorization — demonstrating identity enrichment with W3C Verifiable Credentials, authorization policy integration, insurance underwriting, and credential revocation.
Structured as W3C Verifiable Credentials — cryptographically secure, privacy-preserving attestations issued by certified auditors, embedded in agent identity profiles, and verified by relying parties including insurers.