2026-10-28 AI Agent Identity News
Summary: Dated digest of raw/2026-10-28-ai-agent-identity-news.md (Wednesday). Estonia: no new development. Other countries: NIST proposes ten design tenets for agent identity management; Georgia officials clarify that the Anthropic agent accessed public Data Hub information, not the voter-registration system; BSI announces BS ISO/IEC 27090:2026 AI-system security guidance. No research (Wednesday).
Sources: 2026-10-28-ai-agent-identity-news.md
Last updated: 2026-10-28
Section 1 — Estonia
No new relevant, non-duplicate Estonia development was verified. The ERR/Cybernetica coverage of the proposed registry was already logged on 2026-10-27, and re-crawls of the ministry FAQ and RIA pages were not counted as new publications (source: 2026-10-28-ai-agent-identity-news.md). The 2026-10-25 agendikood position stands; see estonia-ai-agent-id and 2026-10-27-ai-agent-identity-news.
Section 2 — Other countries
- United States — NIST design tenets (27 Oct; primary government; hour unavailable): NIST Cybersecurity Insights proposes ten tenets: distinct, cryptographically verifiable agent identities tied to the initiating person or organization; progressively narrower delegated authority; no persistent privilege while idle; short-lived, revocable grants; risk-triggered human review; signed mandates stating intended outcomes and constraints; policy enforcement separated from model reasoning with deterministic access decisions; continuous monitoring and independent, tamper-evident evidence. It draws on public comments, will inform NCCoE demonstrations, and is an initial vision, not a requirement or standard; NIST acknowledges existing standards cannot yet satisfy every tenet (source: 2026-10-28-ai-agent-identity-news.md, citing NIST — Design Tenets for Agent Identity Management Systems). See united-states-ai-agent-policy, agent-authorization-and-delegation.
- United States (Georgia) — incident clarification: StateScoop (27 Oct, secondary) reports officials saying an Anthropic agent accessed public information via the state’s Data Hub, not the voter-registration system or individual voter records. The Secretary of State’s statement (26 Oct, primary, before the news window) says Anthropic confirmed on 26 Oct that the agent did not access the voter list or bypass a paywall. The conclusion is attributed to the state; no independent forensic report was inspected (source: 2026-10-28-ai-agent-identity-news.md, citing StateScoop; Georgia Secretary of State). See united-states-ai-agent-policy.
- United Kingdom / international — BSI (27 Oct; primary standards body; hour unavailable): BSI announced BS ISO/IEC 27090:2026, guidance on security threats across the AI-system lifecycle (threat-to-asset mapping, prompt injection, information leakage). Broader AI security, not an agent-identification or delegation specification; the announcement was inspected, the standard was not, and 27 Oct is not proof of first issue (source: 2026-10-28-ai-agent-identity-news.md, citing BSI). See united-kingdom-ai-agent-policy, agent-standards-and-interoperability.
Section 3 — Research
Omitted (Wednesday).
Contradictions
None. The Georgia item is a clarification of an incident account not previously recorded in this wiki; it does not overturn the Anthropic 9 October disclosure recorded in united-states-ai-agent-policy (which spoke generally of federal, state and local sites). No earlier dated page needs a correction note.