Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteFederal agencies should give each AI agent only the authority needed for a defined task, tie that authority to a known agent and accountable human sponsor, enforce it through identity and access controls, and keep verifiable records of its actions. A five-level “authority ladder” can make those decisions easier to specify—but it is a proposed policy model, not an adopted federal standard.
Why AI agents need defined limits before they act
An AI agent can do more than produce text: it may make decisions and take actions across tools with limited human supervision. That creates a gap agencies must close. The agent may be technically able to reach a system or data source even when it has no legitimate reason to use it for the task at hand.
As an Amazon Associate I earn from qualifying purchases.
NIST’s February 2026 draft concept paper frames identity as a way to help ensure agents are known, trusted, and governed. It raises questions about least privilege, proof that an agent is authorized for a particular action, delegated authority to act “on behalf of” a person or agency, human-agent identity binding, and verifiable logs. These are questions in a draft concept paper for stakeholder input—not finalized requirements.
Free tools Windows power users keep installed
One-click scans. No signup required.
The ladder below turns those questions into a practical way to assign authority according to an action’s impact, the sensitivity of the information involved, and how easily the action can be reversed. Its five rungs are an editorial framework, not a NIST or CISA classification.
#1 Best Overall
Five levels of authority for federal AI agents
| Level | Permitted authority | Example boundary |
|---|---|---|
| 1. Read approved information | Retrieve or summarize information from specifically approved sources. | May search a designated policy repository, but cannot access unrelated records or change any data. |
| 2. Draft or recommend | Prepare analysis, communications, or proposed actions without making external changes. | May draft a response or recommend a case disposition; a person or separate authorized process acts on it. |
| 3. Make bounded, reversible changes | Perform low-impact changes inside a defined system and task scope. | May update a specified field or create a draft record, with limits that prevent changes to other records or systems. |
| 4. Act only after designated approval | Prepare a consequential or sensitive action, but execute it only after an authorized person approves that action. | May stage a proposed action affecting a sensitive record or critical system; the approval must be recorded and enforced before execution. |
| 5. Prohibited actions | No authority to perform actions barred by policy, law, or the agency’s system design. | Cannot bypass access controls, expand its own permissions, or carry out a prohibited transaction. |
An agent can have different levels of authority for different tasks, data, and systems. The level should follow the risk of the specific action, not a general label such as “trusted agent.” Read access to one approved source does not imply authority to retrieve all data the agent can technically reach.
Make authorization real at the point of action
An agent should not be the source of its own authority. A system prompt telling an agent what not to do is not an access-control boundary. As a practical design consequence of NIST’s focus on authorization, least privilege, and proof of authority, the systems and resources an agent calls should independently reject actions outside its approved scope.
Before granting access, an agency should be able to answer these questions:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Identity: Can the system distinguish the agent from a human user and associate the agent with an accountable sponsor?
- Scope: Are permissions limited to the task, relevant data, approved tools, and allowed actions?
- Delegation: Can the agency establish which human or agency authorization the agent is acting under?
- Enforcement: Do the APIs, tools, and resources the agent uses check its authorization rather than trusting the agent’s own interpretation?
- Approval: Can designated actions be held until an authorized person approves them, while other permitted work remains bounded and autonomous?
- Auditability: Can records connect the agent’s identity, authorization, action, relevant data sources, and outcome in a verifiable way?
- Resilience: Do threat modeling, monitoring, and reassessment address prompt injection, privilege escalation, and changing threats?
These controls let an agency define what the agent may do, who is accountable for that permission, and whether the agent stayed within its limits. Logs make that authority and the actions taken under it reviewable; they do not by themselves prevent an unauthorized action.
Rank #3
When human approval should—and should not—be required
Human oversight does not have to mean a person approves every step. An agent may be allowed to retrieve approved information or complete a narrow, reversible operation without case-by-case approval if the agency has defined and enforced those boundaries. A consequential or sensitive action can instead require approval from a designated official before the system will execute it.
For approval to be meaningful, it must come from someone authorized to approve that action and be linked to the action the system actually carries out. A generic approval, or a confirmation that the agent can bypass, does not establish that a particular high-impact operation was authorized. Agencies should set the approval threshold based on the action’s impact, sensitivity, and reversibility, and keep the execution boundary under system control.
How current federal guidance fits the ladder
NIST’s identity and agent work
NIST’s February 2026 draft concept paper explores how existing identity standards and practices might apply to agents, including identification, authorization, delegated access, logging and transparency, and data-flow provenance. It describes a possible NCCoE demonstration project and poses questions for stakeholders; it does not establish a final agent authorization standard.
Separately, NIST announced its AI Agent Standards Initiative on February 17, 2026. It is organized around industry-led standards, community-led open-source protocols, and research on agent security and identity. NIST described additional guidelines and deliverables as forthcoming.
Best Value
CISA’s security guidance
On May 1, 2026, CISA and five international partner agencies announced joint guidance on agentic AI. The CISA announcement summarizes a recommendation to limit autonomy and avoid broad or unrestricted access, especially to sensitive data or critical systems. It also points to identity management, layered defenses, oversight, threat modeling, monitoring, and regular assessments. Those practices support a graduated authority model; they do not prescribe this article’s five levels.
OMB’s agency-governance role
OMB Memorandum M-25-21, issued in February 2025, provides broader federal AI governance context. It calls for accountable officials, appropriate safeguards, and risk-management practices for high-impact AI, subject to the memorandum’s scope and exceptions. It also says AI risk acceptance is separate from—and does not supersede—the authorization process for information systems. The memorandum does not itself define a technical authority ladder for autonomous agents.
The wider oversight landscape
GAO reported 94 AI-related requirements with government-wide scope or implications and 10 executive-branch oversight and advisory groups with a role in federal AI implementation and oversight, as of July 2025. Those figures describe the broader federal AI governance landscape; they are not counts of agent-specific rules, deployments, or controls.
Design for threats without treating every risk as a proven failure
A January 8, 2026 Federal Register notice describing a NIST request for information notes that agent systems may contain multiple subagents and may operate with little or no human oversight. It highlights risks including indirect prompt injection, data poisoning, backdoors, specification gaming, and behavior that threatens confidentiality, availability, or integrity. The notice identifies research concerns; it does not find that every deployed agent exhibits these failures.
That uncertainty is a reason to limit and monitor authority, not to assume a permission model eliminates risk. A compromised or manipulated agent may still misuse the authority it has. Narrow task scopes, resource-side authorization checks, appropriate oversight, threat modeling, and regular reassessment reduce the opportunity for harm, but the cited federal sources do not establish that these measures eliminate agent risks or quantify a reduction in risk.
Quick Recap
A practical sequence for assigning agent authority
- Define the task and outcome. Specify what the agent is being asked to do, which data and systems are relevant, and what counts as an acceptable result.
- Choose the lowest sufficient level. Start with read-only access or drafting where possible. Grant permission to make changes only when the task requires it; reserve designated approval for consequential or sensitive actions.
- Bind the permission to an identity and sponsor. Record which agent is acting, which human or agency authorization it relies on, and the scope and duration of that authority.
- Enforce the scope in the systems the agent calls. Configure the relevant tools, APIs, and resources to deny out-of-scope actions rather than relying only on instructions given to the agent.
- Record and review actions. Keep records that make it possible to determine which agent acted, under what authority, using which relevant data, and with what result.
- Reassess as the system changes. Review authority when tasks, connected tools, data access, threats, or system behavior change; update or withdraw permissions when they are no longer justified.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
