Standards Contributions
Formal contributions to government standards processes on AI agent security, identity, and authorization. Each submission is grounded in Agent Gate, a working open-source implementation with arguments backed by shipped code.
NIST CAISI: Security Considerations for Artificial Intelligence Agents
Public comment · Docket NIST-2025-0035 · Filed March 2026
Response to the Request for Information from NIST's Center for AI Standards and Innovation on securing AI agent systems. Core recommendation: AI agent frameworks should provide a documented, enforceable interception point between model output and tool execution, the interception point already exists in every major framework; the standard does not. Includes six recommendations spanning default-deny postures, agent-unreachable recovery mechanisms, tool effect annotations, and policy-as-code authorization, with control mappings to NIST SP 800-53, the AI Risk Management Framework, ISO 42001, and OMB M-24-10.
NIST NCCoE — Software and AI Agent Identity and Authorization
Concept paper response · Filed April 2026 · Project status: under review
Response to the National Cybersecurity Center of Excellence concept paper "Accelerating the Adoption of Software and AI Agent Identity and Authorization." Proposes three demonstration priorities: a standard approval-record schema binding human authorization decisions to specific agent actions with cryptographic non-repudiation; just-in-time authority grants with time-bound, scope-bound expiration; and strict scope-reduction rules for agent-to-agent delegation, so no spawned agent ever holds broader authority than its parent.
ISED Canada — Advancing AI Transparency in Canada
Public consultation submission · Filed August 2026
Response to Innovation, Science and Economic Development Canada's consultation on the discussion paper "Enhancing Trust in Artificial Intelligence Through Increased Transparency," addressing the AI Incidents and AI Agents areas. Core argument: tracking agent activity is a by-product of enforcement, an authorization layer at the execution boundary generates complete, tamper-evident records as a side effect of doing its job. Proposes an agent incident record schema anchored to the structured tool call, a confidential no-fault near-miss reporting channel modelled on aviation safety, and seven recommendations including evidentiary standards for agent audit trails and strict scope reduction for multi-agent delegation.
UK DSIT — Data Regulation in the Age of AI
Call for evidence response · Filed August 2026
Response to the UK Department for Science, Innovation and Technology's call for evidence "Data regulation in the age of AI and other data-intensive technologies," addressing themes on data access, cross-organizational governance, transparency and rights, and framework effectiveness. Core argument: UK data protection principles are stable, but they assume processing specified by humans at design time, agentic AI makes processing emergent at runtime, so the framework's needed adaptation is a named architectural precondition: an enforceable interception point between model output and tool execution, per-action authorization against declared policy, and tamper-evident records of proposals as well as outcomes. Raises derivative sensitivity, agents aggregating individually low-sensitivity data into outputs exceeding any input, as a data protection question, and proposes evidencing "meaningful human involvement" per decision.
The through-line
Every submission makes the same structural argument from a different angle: the reasoning layer of an AI agent cannot be trusted to enforce its own boundaries, so enforcement must live at the execution boundary, external to the agent, verifiable without the agent's cooperation, and unreachable by the agent it constrains. This is the same principle behind nuclear surety systems: Permissive Action Links never evaluated whether a launch was wise. They verified whether it was authorized.
The reference implementation for these submissions is Agent Gate (Apache 2.0).