Foundations
Foundations
The Workforce Nobody Manages
Three million AI agents operate inside corporations. Walmart employs 2.1 million people across twenty countries and can account for every one of them. Recent surveys found nearly a quarter of organizations can't produce a list of their agents. Another quarter track them on spreadsheets. No inventory, no ownership records, no offboarding process. Everyone files these as security findings. But read that list of failures again, slowly. They sound like a workforce-management audit where every line item is red. Workforce-management failures call for workforce-management fixes.
The Workforce Nobody Manages
Three million AI agents operate inside corporations. Walmart employs 2.1 million people across twenty countries and can account for every one of them. Recent surveys found nearly a quarter of organizations can't produce a list of their agents. Another quarter track them on spreadsheets. No inventory, no ownership records, no offboarding process. Everyone files these as security findings. But read that list of failures again, slowly. They sound like a workforce-management audit where every line item is red. Workforce-management failures call for workforce-management fixes.
NIST Is Running a Design Review on Agent Identity. The First Window Closes in Twelve Days.
Roughly one in five organizations treats AI agents as entities that deserve their own identity credentials. The rest use shared service accounts or hardcoded keys. While practitioners figure this out in production, two teams inside NIST are writing the federal definitions of "agent identity," "authorization scope," and "agent security." Those definitions will harden into compliance language, procurement requirements, tooling categories. The vocabulary is still soft. The first comment window closes March 9. And the process is asking questions that sound a lot like a design review.
NIST Is Running a Design Review on Agent Identity. The First Window Closes in Twelve Days.
Roughly one in five organizations treats AI agents as entities that deserve their own identity credentials. The rest use shared service accounts or hardcoded keys. While practitioners figure this out in production, two teams inside NIST are writing the federal definitions of "agent identity," "authorization scope," and "agent security." Those definitions will harden into compliance language, procurement requirements, tooling categories. The vocabulary is still soft. The first comment window closes March 9. And the process is asking questions that sound a lot like a design review.
Further Reading
