Agent Security: From Ad-Hoc to Standardized

Three significant developments this week signal that agent security is maturing from ad-hoc best practices to formalized standards:

NIST Concept Paper on Agent Identity — NIST published its first formal concept paper on AI agent identification, authorization, access delegation, and logging. Comments due April 2. This will become the baseline standard for enterprise agent deployments. If you're building agent systems, start aligning with NIST's identity framework now — retrofitting it later will be painful. NIST NCCoE

DeepMind Delegation Capability Tokens — Google DeepMind proposed an adaptive framework using cryptographic "Delegation Capability Tokens" (DCTs) with caveats for least-privilege agent delegation. Contract-first task decomposition. This is the most significant agent security architecture since MCP — it solves the "how do agents safely delegate to other agents" problem that every multi-agent system faces. arXiv

SAFE-MCP Framework — A community-built framework adapting MITRE ATT&CK methodology for MCP security. 14 tactical categories, Linux Foundation governance. Think of it as "OWASP for MCP" — a structured way to assess and mitigate agent integration risks. The New Stack