SP 800-53 was designed for human operators. NIST's COSAiS project is adding AI agent overlays, but the agent-specific controls are still in development. SWT3's NHI, MCP, and chain procedures fill the gaps today.
Who this is for: FedRAMP assessors evaluating agentic AI systems, federal IT security teams extending 800-53 baselines for autonomous agents, 3PAOs conducting agent-specific security assessments, ISSMs managing agentic AI authorizations within federal enclaves, and architects deploying MCP-based agent systems in government environments.
Critical Assessor Notice: Boundaries of Cryptographic Evidence
SWT3 witness anchors prove that specific operational controls were active at a specific point in time. They do not replace the assessor's independent judgment, professional expertise, or regulatory authority. Assessors must verify that anchored evidence is sufficient, appropriate, and relevant to the specific FedRAMP or RMF assessment context.
Extends Existing COSAiS Crosswalk
This guide covers agent-specific control gaps (single-agent and multi-agent use cases). For the predictive AI and generative AI overlays already in COSAiS zero draft, see the NIST COSAiS Crosswalk guide. The two guides are complementary.
| Project | Control Overlays for Securing AI Systems (COSAiS) |
| Authority | NIST (National Institute of Standards and Technology) |
| Agent Use Cases | Single-agent AI (autonomous decision-making) and Multi-agent AI (cooperative goal pursuit) |
| Overlay Status | In active development. Predictive AI annotated outline published Jan 8, 2026. Zero draft published July 29, 2026 (comment closed Sept 16). Agent-specific overlays in discussion draft as of October 2026. |
| CAISI Initiative | AI Agent Standards Initiative announced Feb 17, 2026 |
| Base Catalog | SP 800-53 Rev. 5 (Security and Privacy Controls) |
| Key Gap | 800-53 lacks controls for non-human principals, agent permission scoping, and multi-agent chain attribution |
| SWT3 Procedures Mapped | 24 procedures across 5 control families (AC, IA, AU, SR, CM) |
SP 800-53 Rev. 5 was designed for information systems operated by human users. Its control families assume that actions are taken by authenticated human principals, that access decisions are made by human administrators, and that audit trails record human activity. Autonomous AI agents break all three assumptions.
NIST recognized this gap and launched the COSAiS project to create AI-specific overlays. The project defines five use cases: predictive AI, generative AI, single-agent AI, multi-agent AI, and AI developer security. The predictive AI annotated outline was published January 2026. The zero draft was published July 29, 2026, with public comment closing September 16, 2026. The agent-specific overlays remain in discussion draft as of October 2026, with final publication expected in 2027.
Organizations deploying agentic AI in federal environments face a compliance gap: they must satisfy 800-53 controls during FedRAMP or RMF authorization, but the catalog does not address agent-specific risks. SWT3 procedures fill these gaps with cryptographic evidence that can be presented to assessors today, before the COSAiS agent overlays are formally published.
NIST's own gap analysis (CAISI, February 2026) identifies three capabilities that 800-53 lacks for agentic systems:
Gap: AC-03 (Access Enforcement) and AC-06 (Least Privilege) assume permissions are granted to human roles. An AI agent performing autonomous actions needs permission boundaries scoped to a specific task, not a role. When an agent delegates to a sub-agent, the delegation scope must be narrower than the parent's scope.
800-53 has no control for: task-scoped agent permissions, delegation scope narrowing, or runtime permission verification for non-human actors.
Gap: IA-02 (Identification and Authentication) and IA-04 (Identifier Management) are built around human identities: usernames, passwords, MFA tokens, PIV cards. An AI agent needs a non-human identity that is cryptographically bound to its creator, version, and authorized scope. Agent credentials must have defined lifecycles: creation, rotation, expiration, and revocation.
800-53 has no control for: non-human identity registration, agent credential lifecycle management, or credential expiration enforcement for autonomous actors.
Gap: AU-02 (Event Logging) and AU-03 (Content of Audit Records) assume that each logged action has a single human principal. In a multi-agent system, Agent A invokes Agent B, which calls a tool via MCP, which triggers Agent C. The audit trail must attribute each action in the chain to the correct agent and link them through a shared chain identifier.
800-53 has no control for: multi-agent chain logging, cross-agent action attribution, or tool-level audit within agent pipelines.
Gap: SR-04 (Provenance) tracks component origins for software supply chains. For agentic AI, provenance extends to: the model powering the agent, the MCP servers it connects to, the tools it can invoke, and the adapters or fine-tunes applied to its base model. An agent's "supply chain" includes its entire capability surface.
800-53 has no control for: model provenance in agent contexts, MCP server trust verification, or tool registry integrity attestation.
Gap: CM-03 (Configuration Change Control) and CM-05 (Access Restrictions for Change) manage system configurations. For agents, the critical configuration is the tool registry: which tools the agent can invoke, what permissions each tool has, and whether tool definitions have been tampered with (tool poisoning). Configuration drift in an agent's tool registry is a security event.
800-53 has no control for: agent tool registry integrity, tool permission drift detection, or MCP server configuration verification.
AI-ACC.1 witnesses access authorization decisions for AI actions. NHI-SCOPE.1 records the defined scope boundaries of a non-human identity credential. NHI-PRIV.1 witnesses the privilege level assigned to the credential. Together, these procedures prove that an agent operated within defined permission boundaries, not with unbounded access.
Map these to AC-03 and AC-06 in the SSP. The anchor chain for NHI-SCOPE.1 demonstrates that the agent's permissions were scoped to a specific task context. Look for NHI-PRIV.1 anchors showing least-privilege assignment.
AI-ID.1 witnesses agent identity binding: which agent performed an action and how that identity was established. NHI-CYCLE.1 records credential lifecycle events (creation, renewal). NHI-ROTATE.1 witnesses key and token rotation. NHI-EXPIRE.1 records credential expiration enforcement including grace periods. These four procedures provide a complete non-human identity lifecycle that 800-53 currently lacks.
Map to IA-02, IA-04, and IA-05 in the SSP. The NHI credential lifecycle procedures directly address the "non-human principal" gap. Include rotation frequency and expiration enforcement evidence to satisfy IA-05 (Authenticator Management).
NHI-AGENT.1 witnesses the registration of a new agent identity, including the binding between the agent and its authorizing principal. NHI-REVOKE.1 records credential revocation events when an agent's authorization is withdrawn. These procedures ensure that decommissioned agents cannot continue operating with stale credentials.
AI-TOOL.1 witnesses each tool invocation: which tool was called, by which agent, with what parameters, and whether it succeeded. AI-TOOL.2 witnesses tool integrity by recording a hash of the tool definition at invocation time. If a tool definition is tampered with (OWASP MCP Top 10 #3: Tool Poisoning), AI-TOOL.2 anchors will show the hash mismatch.
Map AI-TOOL.1 to AU-02 (tool-level audit events) and AI-TOOL.2 to SI-07 (Software, Firmware, and Information Integrity). The tool integrity hash addresses configuration management for agent tool registries.
AI-MCP.1 witnesses the MCP session security posture (8 observable checks). AI-MCP.2 attests tool integrity within the MCP session. AI-MCP.3 witnesses whether mutual authentication occurred between client and server. AI-MCP.4 records transport encryption evidence. These four procedures cover the complete OWASP MCP Top 10 risk surface for agent-to-server communication.
Map AI-MCP.3 to IA-08 (Identification and Authentication for Non-Organizational Users) and AI-MCP.4 to SC-08 (Transmission Confidentiality and Integrity). MCP is the dominant transport protocol for agentic AI; these procedures provide the evidence that 800-53 session controls are satisfied at the agent communication layer.
AI-CHAIN.1 witnesses agent-to-agent handoffs in multi-agent pipelines using shared cycle IDs. AI-CHAIN.2 correlates evidence across chain boundaries. AI-DEL.1 records delegation authorization events (which agent authorized which sub-agent). AI-DEL.2 witnesses the scope boundaries of each delegation, ensuring the sub-agent's permissions are narrower than the parent's.
These four procedures are the most critical for multi-agent systems. Map to AU-02 (chain event logging), AU-06 (Audit Record Review), AC-03 (delegation scope enforcement), and AC-06 (least privilege across delegation chains). The cycle ID linkage provides the forensic attribution trail that 800-53 AU controls assume but cannot produce for multi-agent systems.
AI-LOG.1 witnesses inference-level audit events: each agent decision, tool call, and output. AI-AUDIT.1 witnesses the integrity of the audit trail itself, detecting tampering or gaps in the evidence chain. For agent systems, AI-LOG.1 provides the per-action audit record while AI-AUDIT.1 ensures the collection of records has not been selectively edited.
AI-SUPPLY.1 witnesses the provenance of an agent's model and tool dependencies. AI-PROV.1 records the parent model fingerprint for fine-tuned or adapted models. AI-SBOM.1 witnesses the AI software bill of materials. These procedures extend SR-04 (Provenance) to cover the agent-specific supply chain: model weights, adapters, MCP servers, and tool libraries.
| COSAiS Agent Gap | 800-53 Control | SWT3 Procedure | Evidence | Coverage |
|---|---|---|---|---|
| Agent access scoping | AC-03 | AI-ACC.1 | Access authorization witness | Full |
| Agent permission boundaries | AC-03 | NHI-SCOPE.1 | Credential scope boundaries | Full |
| Agent least privilege | AC-06 | NHI-PRIV.1 | Privilege level assignment | Full |
| Agent identity | IA-02 | AI-ID.1 | Agent-to-principal binding | Full |
| Credential lifecycle | IA-04 | NHI-CYCLE.1 | Create/renew events | Full |
| Credential rotation | IA-05 | NHI-ROTATE.1 | Key/token rotation | Full |
| Credential expiration | IA-05 | NHI-EXPIRE.1 | Expiration enforcement | Full |
| Agent registration | IA-04 | NHI-AGENT.1 | Identity registration | Full |
| Credential revocation | IA-05 | NHI-REVOKE.1 | Revocation events | Full |
| Tool authorization | AU-02 | AI-TOOL.1 | Tool call witness | Full |
| Tool integrity | SI-07 | AI-TOOL.2 | Tool definition hash | Full |
| MCP session security | SC-23 | AI-MCP.1 | 8 security checks | Full |
| MCP tool integrity | SI-07 | AI-MCP.2 | Tool hash verification | Full |
| MCP server auth | IA-08 | AI-MCP.3 | Mutual auth evidence | Full |
| MCP transport | SC-08 | AI-MCP.4 | Encryption evidence | Full |
| Multi-agent chain | AU-02 | AI-CHAIN.1 | Chain handoff with cycle ID | Full |
| Cross-chain evidence | AU-06 | AI-CHAIN.2 | Cross-chain correlation | Full |
| Delegation authorization | AC-03 | AI-DEL.1 | Delegation authorization | Full |
| Delegation scope | AC-06 | AI-DEL.2 | Scope boundary narrowing | Full |
| Inference audit trail | AU-02, AU-03 | AI-LOG.1 | Per-action audit events | Full |
| Audit integrity | AU-09 | AI-AUDIT.1 | Tamper detection | Full |
| Agent supply chain | SR-04 | AI-SUPPLY.1 | Model/tool provenance | Full |
| Component provenance | SR-04 | AI-PROV.1 | Parent model fingerprint | Full |
| Agent SBOM | SR-11 | AI-SBOM.1 | Software bill of materials | Full |
Federal deployments of agentic AI may operate at different classification levels. SWT3 clearing levels control what evidence leaves the deployment boundary:
| Clearing Level | Data in Anchor | Federal Use Case |
|---|---|---|
| Level 0 (Analytics) | Full operational data including model inputs/outputs | Development and test environments, unclassified systems |
| Level 1 (Standard) | Identifiable but privacy-filtered | FedRAMP Moderate systems, most RMF authorizations |
| Level 2 (Sensitive) | Pseudonymized, model names hashed | FedRAMP High systems, PII-bearing workloads |
| Level 3 (Classified) | Metadata only: procedure ID, timestamp, pass/fail | Sovereign enclaves, IL4/IL5 environments, air-gapped deployments |
At every clearing level, the cryptographic fingerprint remains verifiable. A Level 3 anchor from a classified agent deployment proves the same thing as a Level 0 anchor from a development environment: a specific procedure was evaluated at a specific time with a specific result. The assessor gets the proof without the operational details.
Organizations with existing 800-53 baselines (FedRAMP, RMF, CMMC) can layer SWT3 agent evidence without modifying their current SSP structure:
When the COSAiS agent overlay is formally published, update the SSP to reference the official overlay controls and retain SWT3 procedures as the evidence source for each control enhancement.
from swt3_ai import Witness
w = Witness(
tenant_id="FED_AGENCY_ENCLAVE",
api_key="your-api-key",
endpoint="https://sovereign.tenova.io/api/v1/witness",
agent_id="agent:procurement-assistant:v2.1",
signing_key="hmac-key-for-anchor-signing",
clearing_level=2 # Sensitive: pseudonymized for FedRAMP High
)
# Witness agent identity registration (NHI-AGENT.1)
w.record("NHI-AGENT.1",
factor_a="agent:procurement-assistant:v2.1",
factor_b="authorized_by:admin@agency.gov",
factor_c="scope:procurement_queries_only")
# Witness tool call (AI-TOOL.1)
w.wrap_tool(my_search_function)(query="FY2027 contract vehicles")
# Witness MCP server authentication (AI-MCP.3)
w.record("AI-MCP.3",
factor_a="mcp_server:agency-data-gateway",
factor_b="auth_method:mtls",
factor_c="PASS:mutual_auth_verified")
w.flush()import { Witness } from '@tenova/swt3-ai';
const w = new Witness({
tenantId: 'FED_AGENCY_ENCLAVE',
apiKey: 'your-api-key',
endpoint: 'https://sovereign.tenova.io/api/v1/witness',
agentId: 'agent:procurement-assistant:v2.1',
signingKey: 'hmac-key-for-anchor-signing',
clearingLevel: 2
});
w.record('NHI-AGENT.1', {
factorA: 'agent:procurement-assistant:v2.1',
factorB: 'authorized_by:admin@agency.gov',
factorC: 'scope:procurement_queries_only'
});
w.wrapTool(mySearchFunction)({ query: 'FY2027 contract vehicles' });
w.record('AI-MCP.3', {
factorA: 'mcp_server:agency-data-gateway',
factorB: 'auth_method:mtls',
factorC: 'PASS:mutual_auth_verified'
});
await w.flush();