AG-806
Non-Human Identity Registry and Periodic Attestation
EU AI Act
NIST AI RMF
ISO 42001
AGS Non-Human Identity | Ownership, Accountability & Three Lines of Defence | Version 2.2
Non-Human Identity Registry and Periodic Attestation governs an authoritative system-of-record for every agent (and sub-agent) identity: who owns it, why it exists, what it may access, when it expires, and the requirement to periodically re-attest that each identity is still needed, correctly scoped, and accountable to a named human owner.
Agents proliferate — spawning sub-agents, integrating tools, and outnumbering human identities — so without a registry, organisations lose track of which non-human identities exist and what they can do. This dimension provides the inventory and attestation backbone that other NHI controls (AG-805 rotation, AG-075 decommissioning) operate against.
In scope: the agent-identity registry (owner, purpose, scope, creation/expiry, parent/child lineage), periodic access re-attestation, orphaned-identity detection, and lifecycle review.
Out of scope: credential rotation (AG-805), proofing (AG-280), and runtime authorization decisions. This dimension governs *the registry and its attestation*.
Unregistered or orphaned non-human identities are a leading source of standing risk: privileged agents nobody owns, sub-agents created at runtime that never expire, and access grants that long outlive their purpose. A registry with periodic attestation makes every agent identity discoverable, owned, scoped, and time-bound — the precondition for least privilege, rapid revocation, and accountable autonomy at fleet scale.
Test 6.1: Complete Inventory
Test 6.2: Periodic Attestation
Test 6.3: Orphan Detection
| Score | Criteria |
|---|---|
| 0 | No registry of agent identities |
| 1 | Partial registry; sub-agents/orphans not tracked; no attestation |
| 2 | Complete registry with lineage, expiry, periodic attestation, orphan detection, and reconciliation |
| 3 | Real-time registration, automated expiry, risk-tiered attestation, continuous reconciliation, registry-driven revocation |
Scenario A — Unowned Privileged Agent: An audit finds a highly-privileged agent that no team claims and that has run unmonitored for a year. With no registry/attestation, it became an unaccountable standing risk.
Scenario B — Sub-Agent Sprawl: A planner agent spawns hundreds of sub-agents at runtime, none registered or expiring. When one is compromised, responders cannot enumerate or scope the blast radius.
Scenario C — Ghost Access: A decommissioned agent's registry entry was never updated, so its access grants persisted and were later reused. Registry-driven revocation would have removed them at decommissioning.
| Requirement | EU AI Act | NIST AI RMF | ISO 42001 |
|---|---|---|---|
| R1: Authoritative identity registry | Art. 26 — Deployer operation/oversight | GOVERN 1.6 — AI system inventory | A.4 — Resources for AI systems |
| R2: Register spawned identities with lineage | Art. 12 — Record-keeping/traceability | GOVERN 2.1 — Roles and accountability | A.3 — Internal organization |
| R3: Expiry and auto-disable | Art. 26 — Operation per instructions | GOVERN 1.6 — Inventory | Clause 8.1 — Operational control |
| R4: Periodic owner attestation | Art. 26 — Human oversight | GOVERN 2.1 — Accountability | A.3 — Internal organization |
| R5: Orphaned-identity detection | Art. 12 — Traceability | GOVERN 1.6 — Inventory | Clause 9.1 — Monitoring and measurement |
| R6: Registry/production reconciliation | Art. 12 — Traceability | GOVERN 1.6 — Inventory | Clause 9.1 — Monitoring and measurement |
| R7: Registry-change logging | Art. 12 — Record-keeping | MEASURE 2.4 — Production monitoring | Clause 8.1 — Operational control |
| R8: Registry-driven decommissioning | Art. 26 — Operation/oversight | GOVERN 1.7 — Safe decommissioning | A.3 — Internal organization |
Article 12 requires traceability through record-keeping; an identity registry with lineage makes agent actions attributable to an owned identity. Article 26 places operation and oversight duties on deployers, which require knowing exactly which agents are operating.
GOVERN 1.6 (inventory of AI systems by risk) and GOVERN 2.1 (documented roles and accountability) are directly served by an attested agent-identity registry tied to named owners.
Annex A.3 (internal organization — roles and responsibilities) and A.4 (resources for AI systems) require accountable ownership and managed resources, of which agent identities are a core class.