How to read this table
Every entry carries a status label, because status is what determines whether you can build on something, cite it to an auditor, or merely watch it. We use five labels:
- Ratified: published RFC, ISO standard, or in-force regulation. Citable to an auditor.
- Standards-track draft: adopted by a working group, on a path to ratification. Architect toward it; do not claim compliance with it.
- Individual draft: submitted but not adopted. No formal standing. Useful reading, not a commitment.
- Published framework: from an industry body. Authoritative guidance, not obligation, not certifiable.
- In development: announced or in consultation. Watch only.
If a vendor tells you they are "compliant with" something in the bottom three tiers, that claim has no defined meaning. Ask which document, which version, and what conformance was assessed against.
Regulation
| Instrument | Jurisdiction | Status | Key dates | NHI relevance |
|---|---|---|---|---|
| EU AI Act (Reg. (EU) 2024/1689) | EU | Ratified, phased | Art. 5 prohibitions in force 2 Feb 2025 · GPAI 2 Aug 2025 · Annex III high-risk deferred to 2 Dec 2027 · Annex I to 2 Aug 2028 · Art. 50(2) marking 2 Dec 2026 | Logging, human oversight, and technical documentation obligations translate directly into agent identity and audit-trail requirements |
| Digital Omnibus on AI | EU | Adopted | Parliament 16 Jun 2026 · Council 29 Jun 2026 | The instrument that deferred the high-risk dates above. A deferral, not a repeal |
| NIS2 | EU | Ratified transposing | National transposition ongoing | Access control and supply-chain security obligations covering machine credentials |
| DORA | EU financial sector | Ratified in application | Applying since 17 Jan 2025 | ICT third-party risk; NHIs held by service providers are in scope |
Standards and protocols
| Document | Body | Status | Latest | What it does |
|---|---|---|---|---|
| ISO/IEC 42001 | ISO/IEC | Ratified. Certifiable | 2023 | AI management system. The only certifiable AI governance standard. See ISO 42001 × NHI |
| ISO/IEC 27001 / 27002 | ISO/IEC | Ratified. Certifiable | 2022 | ISMS. Annex A access-control and cryptography controls apply to machine credentials |
| NIST SP 800-207 (Zero Trust) | NIST | Ratified | 2020 | Codifies Zero Trust. The architectural basis most agent frameworks build on |
| NIST AI RMF 1.0 | NIST | Ratified (voluntary) | Jan 2023 | AI risk management. Voluntary framework, widely referenced |
| OAuth 2.0 Token Exchange (RFC 8693) | IETF | Ratified | Jan 2020 | Converting a broad credential into a narrow downstream one. The delegation workhorse |
| DPoP (RFC 9449) | IETF | Ratified | 2023 | Proof of possession for OAuth tokens. Under-implemented and increasingly important |
| SPIFFE / SPIRE | CNCF | Production, CNCF graduated | Ongoing | Workload identity in practice. What to deploy today. See SPIFFE/SPIRE |
draft-ietf-wimse-arch-07 | IETF WIMSE | WG draft Informational | Mar 2026 | Workload identity architecture and threat model |
draft-ietf-wimse-identifier-03 | IETF WIMSE | WG draft | Jul 2026 | Canonical Workload Identifier URI format |
draft-ietf-wimse-workload-creds-02 | IETF WIMSE | WG draft | Jul 2026 | Workload credentials, X.509 and JWT based |
draft-ietf-wimse-wpt-01 | IETF WIMSE | WG draft | Mar 2026 | Workload Proof Token: request-bound proof of possession |
draft-ietf-wimse-workload-identity-practices-05 | IETF WIMSE | WG draft Informational | Jun 2026 | Survey of existing workload identity practice across Kubernetes, clouds, CI/CD |
draft-klrc-aiagent-auth-02 | IETF (individual) | Individual draft | Jun 2026 | AI agent authentication and authorization by composing WIMSE and OAuth. Authors from Defakto, AWS, Zscaler, Ping Identity, OpenAI, Okta |
| Transaction Tokens (TraTs) | IETF OAuth WG | Standards-track draft | Ongoing | Propagating authorization context across internal service chains |
| AuthZEN | OpenID Foundation | Specification, active WG | Ongoing | PEP/PDP interface. Deliberately not a policy language |
| Shared Signals Framework / CAEP | OpenID Foundation | Published | Ongoing | Real-time security event sharing. The revocation layer |
| Model Context Protocol authorization | Agentic AI Foundation (Linux Foundation) | Specification actively revised | Ongoing | Mandates OAuth 2.1 + PKCE for protected HTTP deployments. See MCP security |
| OIDC-A (OpenID Connect for Agents) | Proposal | Proposal | , | Agent identity, delegation-chain validation, attestation. Watch; do not build on |
Frameworks and guidance
| Framework | Body | Status | Published | What it is for |
|---|---|---|---|---|
| OWASP Non-Human Identities Top 10 | OWASP | Framework | 2025 | Risk enumeration for NHIs. The most useful single starting point for an assessment |
| OWASP Top 10 for Agentic Applications | OWASP GenAI Security Project | Framework | Dec 2025 | Threat enumeration for agentic systems |
| CSA Agentic Trust Framework | Cloud Security Alliance | Framework CC BY 4.0 | 2 Feb 2026 | Zero Trust governance for agents. Five elements, four maturity levels |
| CSA MAESTRO | Cloud Security Alliance | Framework | 2025 | Agentic threat modelling. Names agent impersonation as a distinct threat class |
| CSA NHI program guide | Cloud Security Alliance | Framework | 2025 | Programme structure for non-human identity |
| Software and AI Agent Identity and Authorization | NIST NCCoE | In development | 5 Feb 2026 (comment closed 2 Apr 2026) | Proposed lab demonstration applying OAuth 2.0, SPIFFE/SPIRE and MCP to agent identity. Authors: Booth, Fisher, Galluzzo, Roberts |
| COSAiS (Control Overlays for Securing AI Systems) | NIST | In development | , | SP 800-53 overlays including single-agent and multi-agent deployments. Possible future FedRAMP AI basis |
| CIS Controls | CIS | Framework | v8.1 | Account management and access control controls that apply to service accounts |
What does not exist yet
An honest tracker records absences as well as entries. As of August 2026 there is no:
- Ratified RFC for workload identity. WIMSE is entirely at draft stage.
- Ratified standard for AI agent identity of any kind.
- Certification scheme for non-human identity governance specifically. ISO/IEC 42001 and 27001 are the nearest certifiable anchors, and neither is NHI-specific.
- Regulatory instrument that names non-human identity as a category. NHI obligations are derived from general access-control, logging, and oversight duties.
- Agreed taxonomy. "Non-human identity," "machine identity," "workload identity," and "agentic identity" overlap inconsistently across bodies. See NHI vs machine identity.
Anyone claiming certification against an "NHI standard" is describing something that does not exist. That sentence is worth keeping to hand during vendor evaluations.
Frequently asked questions
Is there an ISO standard for non-human identity?
No. There is no ISO standard specific to non-human identity governance. The nearest certifiable anchors are ISO/IEC 27001, whose Annex A access-control and cryptography controls apply to machine credentials, and ISO/IEC 42001 for AI management systems where agents are in scope. Any claim of certification against an NHI standard is describing something that does not exist.
What is the difference between a standards-track draft and an individual draft at the IETF?
A standards-track draft has been adopted by a working group and is on a path to becoming an RFC through consensus review. An individual draft has been submitted by authors but not adopted, has no formal IETF standing, and can be cited only as work in progress. draft-klrc-aiagent-auth, the most widely referenced AI agent identity document, is an individual draft.
Which NHI standards can I cite to an auditor?
Only ratified instruments: ISO/IEC 27001 and 42001, in-force regulation such as the EU AI Act, NIS2 and DORA, published RFCs such as RFC 8693 and RFC 9449, and NIST publications such as SP 800-207. Published industry frameworks like the OWASP NHI Top 10 and the CSA guides are credible supporting references but are not obligations and are not certifiable.
When will WIMSE become an RFC?
No date has been set. WIMSE has multiple documents at working-group draft stage covering architecture, workload identifier, workload credentials, and the workload proof token, with drafts revised through mid-2026. IETF timelines are consensus-driven and not predictable, which is why the practical advice is to deploy SPIFFE-shaped workload identity now rather than wait.
How often is this tracker updated?
Quarterly for standards and frameworks, and immediately on any status change such as a draft being adopted, an RFC being published, or a regulatory date moving. Every row carries a status label and a date. Changes are recorded in our public corrections log.
Assess your own NHI programme.
Run the free maturity assessment or the OWASP NHI Top 10 self-audit, get your score in the browser, and unlock the full written report.