Identity moves into
the execution path.

01 / In the reporting window

What changed

September 29 · NIST selects DevSecOps as its first implementation use case

NIST’s National Cybersecurity Center of Excellence published a summary of feedback on its software and agent identity initiative, drawing on more than 600 commenters. Its Secure Software Development project will supply the first environment for demonstrating agent identification, authentication, and authorization across the software development lifecycle. A new resource hub supports rolling feedback; additional use cases remain to be scoped.

Why it matters: the discussion is moving toward a concrete environment where identity controls can be demonstrated. For engineering agents, the interesting boundary is the authority to read code, modify it, run a pipeline, or publish an artifact. The September update is a project milestone, not a completed implementation or a new mandatory standard.

NIST project update · September 29, 2026

October 6 · SailPoint connects governance to runtime controls

At Navigate, SailPoint announced expanded Agentic Fabric capabilities spanning shadow-agent discovery, runtime authorization, lifecycle controls, and agent shutdown. The announcement also describes just-in-time provisioning and exportable audit evidence, alongside agents intended to monitor activity and adjust privileges.

Availability: SailPoint says capabilities across Agentic Fabric, Human Fabric, and Atlas begin rolling out at Navigate. A-ISPM, the Harbor Pilot Policy Agent, and the Proofpoint integration are expected in Q4 FY27. The Entro integration is described as nearing completion. Those are distinct rollout commitments, not evidence that every announced feature is generally available now.

Why it matters: access governance and live action control are converging in the product roadmap. The evaluation question is whether a deployed control can intercept the relevant action before it executes, across the actual tools an enterprise uses.

SailPoint Navigate announcement · October 6, 2026 (PDF)

October 7 · RSA announces Agent ID for regulated environments

RSA announced Agent ID at World Summit AI, positioning discovery, agent registration, named ownership, bounded permissions, and policy checks at tool-and-argument depth as part of a lifecycle offering for regulated organizations. Its announcement emphasizes attributable records for governed actions.

Availability: RSA gives November 16, 2026 as the planned general availability date for Discover and Secure. Govern is planned for the first half of 2027. This is an announcement in this reporting window, with delivery dates ahead.

Why it matters: the language of IAM is expanding from an account’s permissions to the authority behind a consequential action. The next test is how those claims behave across delegation, revocation, and tools that sit outside a vendor’s native environment.

RSA Agent ID announcement · October 7, 2026

02 / Research signals

Four boundaries worth watching

These are preprints and controlled studies. They identify useful failure modes; they do not establish universal protection or production readiness.

September 27 · Credential custody belongs outside the model

A new study of vault-mediated execution evaluates a design where the model selects a connector identifier and a trusted boundary supplies authentication. Its 16 probes met their expected outcomes, while a separate misconfigured connector failed its provider’s authentication contract. The authors explicitly characterize the work as a small functional evaluation, not certification.

Our interpretation: secret storage and action authorization solve different problems. A credential can remain hidden while an agent still requests an inappropriate action; both boundaries need enforcement.

Vault-mediated credential study · submitted September 27, 2026

October 2 · Permission and task relevance are separate signals

A task–tool matching paper investigates small language models as per-call relevance classifiers across tasks involving multiple MCP servers. A classifier evaluates whether the selected tool fits the assigned task, supplying a signal for downstream enforcement.

Our interpretation: the architectural separation matters more than the model choice. Relevance may inform a decision, but a probabilistic judgment should not silently grant authority or replace a deterministic permission boundary.

Task–tool intent-matching preprint · submitted October 2, 2026

October 3 · A correct-looking answer can still fail the authority check

A study of agentic label harmonization separates label agreement from authority to propose an action, output completeness, and responsiveness to changed evidence. Its tests use two neuroimaging cohorts and rule-derived reference labels. Agreement measures consistency with those rules, not independent correctness.

Our interpretation: evaluation should test whether an agent was entitled to act, as well as whether its answer matched a reference. The study’s domain-specific results should not be generalized into an IAM benchmark.

Label Agreement Does Not Measure Authorization · submitted October 3, 2026

October 6 revision · Protect the rules that decide access

The revised “Subjects, Not Authors” paper examines agents that both consume governed data and draft governance artifacts. It finds that changing a field’s classification can alter authorization without changing policy text, so reviewing only the policy diff misses a consequential change. The authors also identify limits in constraints covering only explicitly named fields.

Our interpretation: classification, policy publication, and access decisions belong to the same security review boundary. Giving an agent permission to edit metadata may change its effective authority even when its own role stays constant.

Subjects, Not Authors · v2 revised October 6, 2026; first submitted September 24

03 / Context and direction

The longer-term developments vector

Earlier context, outside this issue’s window: CrowdStrike’s September 2 Agentic Identity Provider announcement described distinct agent identities, short-lived access, and attribution to the humans or workloads behind them. Proofpoint’s September 22 post argued for bringing task intent and data-access context into identity decisions. These earlier positions help explain why October’s announcements focus on the execution path. CrowdStrike, September 2; Proofpoint, September 22.

Editorial outlook: together, the sources suggest five connected developments. This is a direction of travel, not a prediction that one architecture or vendor will win.

1. From agent accounts to attributable delegation

A durable agent identity needs to connect to an accountable owner and the principal whose authority it uses. As agents delegate, the useful record becomes a chain: who authorized the task, which agent acted, and what limits traveled with the delegation. Registration is necessary context; it does not by itself prove every downstream action was authorized.

2. From standing privilege to authority at the moment of action

Short-lived access and just-in-time provisioning reduce how long privilege exists. The next layer evaluates the concrete call, its arguments, current evidence, and whether the original grant still holds. A real control must be able to stop the call or prevent a protected result from being released.

3. From IAM alone to IAM joined with data and intent

Permission checks, task relevance, and data sensitivity answer different questions. Their convergence creates a richer decision surface, but also more policy inputs to protect. A change to classification or an approval record can matter as much as a change to the access policy itself.

4. From model advice to an independent execution boundary

Models can help classify intent, draft rules, and explain anomalies. Their outputs need a separately governed path to enforcement. The agent should not gain authority merely because it produced a plausible justification, nor should a drafted policy become active without its authorized publication path.

5. From activity logs to evidence of authority and outcome

The valuable audit trail connects the grant, the decision, the executed action, and the observed result. Over time, buyers will need to distinguish a recorded tool call from proof that a control actually applied, and a successful API response from evidence that the intended task was completed.

04 / Next signals

What to watch next

• Implementation evidence: NIST’s DevSecOps demonstration and whether it yields reusable deployment patterns. Its next project webinar is scheduled for October 28, according to the September 29 update.
• Delivery against announcements: RSA’s November Discover/Secure milestone, its later Govern release, and SailPoint’s staged availability. Track shipped enforcement separately from roadmap language.
• Delegation and revocation: evidence that permissions stay bounded through agent-to-agent handoffs, and that revoked authority stops downstream actions.
• Control evaluation: tests for stale approvals, inappropriate but permitted calls, metadata changes, and gaps between detection and interception.

The question for the next edition is whether these systems can show the authority behind a specific action, enforce its limits before execution, and provide evidence of what happened afterward.

Editorial notes

This digest is a selected review of primary sources available on October 7, 2026, not an exhaustive market census. Dates follow the originating announcement or paper version; the September 24 paper is included only for its October 6 revision. Vendor claims are attributed, and availability language is preserved. Research summaries are based on the linked abstracts and submission histories.

Published by AgentAction, which develops agent action controls and execution assurance. The analysis reflects that perspective; it is not independent product testing or an endorsement of the vendors discussed.