Washington Just Listed Agent Identity as a National Security Technology

For two years the argument about AI agent identity has been a security team argument. It lived in access reviews and credential rotation schedules, and it lost most of its budget fights to whatever was on fire that quarter. That argument just picked up an unlikely ally.

On August 17 the White House released the National Security Science and Technology Strategy. It came from the Office of Science and Technology Policy, it sets federal research and acquisition priorities, and it has nothing to say about enterprise governance. Most of it concerns undersea capability, space, hypersonics, and semiconductors.

Then you reach Appendix A. Under artificial intelligence and autonomy, the list includes planning, reasoning, and decision-making. Multi-agent systems and swarm intelligence.

Autonomous command and control. Interpretability and control. And, on its own line, autonomous agent identification and authentication.

Read where that line sits. It is filed under artificial intelligence and autonomy.

Digital identity technologies and biometrics appear elsewhere in the same appendix, in a different category, under information management and cybersecurity. The federal taxonomy splits them. It does not treat authenticating an agent as a variation on authenticating a person. It treats it as a distinct capability inside the autonomy problem, at the level of a national security technology.

That is not a governance position. The strategy takes none. But taxonomies are how institutions decide what counts as a separate problem, and anyone who has argued that agents need their own identities rather than borrowed ones now has a primary source to point at, from an office with nothing to sell.

The document is also candid about the pressure it creates. Its third pillar is agility: faster innovation, shorter acquisition cycles, milestone-based contracting, removal of administrative and regulatory burden, and a culture that lets programs fail fast and pivot. Its trends section observes that military applications of advanced technologies compress decision timescales.

Hold those two facts together. Autonomous command and control is on the capability list. Compression of decision time is on the trends list. Acceleration is the strategy.

Nothing about that shape is unique to defense. It is what every enterprise is now living through. Adoption accelerates, the interval between a system’s inference and its action collapses, and the governance function keeps meeting monthly. A committee that convenes on the second Tuesday cannot govern an action that completed on the first Friday. Governance that sits outside the execution path is not slow governance. It is documentation of things that already happened.

The strategy names the technical capabilities. It does not name who authorizes an autonomous system to act, which decisions may be delegated, who owns the consequences, or who may pause it. That is not a criticism. A research prioritization document was never going to carry decision rights, and it would be a category error to look for them there. But it marks the boundary precisely. The state is funding the control surface. The authority question sits somewhere else.

There is one more idea in the document worth taking, and I will take it openly.

Discussing resilience, the strategy sets a design goal for national architectures. The aim is not imperviousness, which it calls rarely affordable, but graceful degradation: an architecture that bends under adversary action or natural disaster rather than failing all at once. The strategy applies that to redundancy across national systems and illustrates it with the nuclear triad. The application to an agentic estate is mine.

Move the principle inside a firm and it exposes how thin most intervention design still is. The dominant pattern is binary. The agent runs, or someone finds the kill switch and everything stops. One control, one state change, and an operator who will do almost anything to avoid using it.

Graceful degradation gives you a ladder before the switch. Raise supervision so actions require approval. Lower the autonomy tier so the agent recommends without executing. Withdraw the high-risk tools. Turn write access into read access. Narrow the scope to fewer systems and less data. Route the work back to the deterministic workflow the agent replaced. Cut the agent off from what it can reach. Each rung removes authority while preserving some capability, and each is reversible in a way a full stop is not.

The switch stays, and it stays for good reasons. Some failures do not deserve negotiation. An agent exfiltrating data, executing unauthorized transactions, propagating across connected systems, or running on credentials you no longer trust should be terminated, not tuned down a tier. And every intermediate rung rests on an assumption worth naming: that the mechanism enforcing the constrained state is itself trustworthy. When you cannot trust the agent, its runtime, or the thing holding it in a degraded state, the correct response is to fail closed. Termination is the one control that does not depend on the control plane behaving.

So the design question is not switch or ladder. Stop authority built only as an emergency switch is authority an organization will hesitate to exercise, and the hesitation is the failure. Give operators intermediate states and intervention becomes an operating capability rather than an exceptional event. The kill switch remains. It becomes the last rung rather than the only one.

That turns stop authority from a single control into an intervention architecture. Most governance models recognize two states, authorized and revoked. An agentic estate needs the states in between, and each transition needs a defined trigger, a named authority entitled to make it, technical enforcement rather than instruction, telemetry proving the new state holds, and a rule for how authority is restored. The last one is the one almost nobody has. Restoring an agent’s authority after a degradation is itself an authority grant, and it deserves the same discipline as the original.

So Washington has now put agent identity, autonomous command and control, and interpretability on the national technology agenda. A June executive order expressly declined to create any licensing or preclearance regime for the models underneath, and directed prosecutors to pursue agent-enabled intrusion under statutes already on the books. What neither document does is name who may authorize an autonomous system to act.

I would not read that silence as a decision to leave the question to deploying institutions. Nothing in either text says so, and neither document had occasion to reach it. But the practical position is the same either way. No answer is arriving from this direction, and the obligations that already attach to your firm’s actions run in the meantime.

Which means the open question was never whether the technical controls will exist. They will. The question is who inside your firm is authorized to grant an agent the ability to act, who can narrow that grant, who can revoke it, who can hand it back afterward, and who answers when any of that is done badly.

Nobody in Washington is going to answer that for you. The list is not the operating model.

Source: The White House, National Security Science and Technology Strategy (Office of Science and Technology Policy, August 2026), Appendix A and the resilience pillar.

About the Author

Alan L. Paris is an AI and financial services expert with deep experience in risk, compliance, and AI governance. He previously led Financial Services Risk and Compliance Architecture at ServiceNow and currently serves as an Adjunct Professor at the University of San Francisco School of Management.