A practical reference architecture for governing agentic AI using identity, least privilege, human approval, scoped capabilities, controlled data access, and observability - based on a real Cloudflare OS deployment at KrisperTech.

Executive Summary The National Institute of Standards and Technology (NIST) is actively exploring how identity, authentication, and authorization must evolve to support AI systems and autonomous agents. Recent federal direction and concept work point toward a future where non-human identities (NHIs), including AI agents, must be governed with the same rigor as human users. For enterprises, this represents a structural shift in how trust is established and enforced. Organizati