NCCoE Response: Software and AI Agent Identity and Authorization

Written response submitted by Ordovera Advisory to the National Institute of Standards and Technology (NIST) National Cybersecurity Center of Excellence (NCCoE) concept paper "Accelerating the Adoption of Software and AI Agent Identity and Authorization," submitted 30 March 2026. The concept paper lists the right standards: MCP, OAuth 2.1, SPIFFE/SPIRE, NGAC. They're individually mature and have adoption. Problems present around how to compose them at the enforcement boundary where agents act. This response follows one argument through all six question groups: authorization with sufficient context is governance. "Is this permitted" and "should this happen" collapse into the same question when the authorization framework carries enough context to evaluate appropriateness at the point of tool execution. This response was submitted to NIST and was not yet published by NIST at time of DOI issuance.