NHIMG Sets OAuth Registration Standard for AI Agent Identities
What happened
NHIMG, a practitioner body focused on non-human identity governance, published guidance on OAuth client registration for AI agents that formalizes how security and identity teams should handle agent credentials. The guidance classifies AI agents as non-human identities and requires that each OAuth client registration be backed by publisher-controlled metadata, a signed statement, or a software attestation before credentials are granted or renewed. Narrow scope assignment is treated as a mandatory constraint, not a configuration preference. This publication follows a growing body of evidence that standing, broadly scoped agent credentials represent a material control gap, including findings covered in NHIMG's earlier action-level runtime controls guidance and an independent audit finding that 91.8% of audited MCP servers lack OAuth protections entirely. The guidance is global in scope and does not target a specific regulatory jurisdiction, positioning it as a practitioner baseline rather than a compliance mandate.
Why it matters
- ·Agent OAuth clients that lack signed attestation or publisher-controlled metadata before onboarding are now below an explicit practitioner baseline, creating documented exposure that regulators and auditors can cite during reviews of access control programs.
- ·Scope drift is identified as a specific risk: credentials issued without narrow, pre-verified scopes can expand over time, a pattern already flagged in control AGT-015 and in recent incidents involving standing agent credentials and seven-incident agentic IAM failures.
- ·Organizations that have deployed AI agents as extensions of existing OAuth flows without separate registration workflows now face a structural remediation effort, since the guidance requires verification at the pre-issuance stage rather than retroactively at audit time.
Governance controls affected
What to do now
- ☐Audit all active agent OAuth client registrations to confirm each has a publisher-controlled metadata record, signed statement, or software attestation on file before the next credential refresh cycle.
- ☐Enforce narrow scope constraints on all new agent OAuth clients at the point of registration, and document the business justification for each scope granted.
- ☐Establish a pre-onboarding verification gate that requires attestation evidence before any agent OAuth client is issued credentials in production environments.
- ☐Map existing agent NHI lifecycle procedures against the NHIMG registration requirements and identify any agents currently operating outside the attestation framework.
- ☐Update vendor contract requirements (PRC-002) to require that third-party AI agent vendors provide publisher-controlled metadata compatible with your OAuth registration workflow.
What to watch next
Compliance teams should monitor whether CISA, NIST, or financial sector regulators incorporate the NHIMG attestation model into binding access control guidance, as practitioner baselines in the NHI space have recently moved quickly toward regulatory citation. The CoSAI token-exchange standard for agentic trust boundaries is a parallel development that may converge with this OAuth registration framework into a unified credential lifecycle standard for agents. Organizations subject to the EU AI Act or financial sector oversight should also assess whether unattested agent credentials create gaps in their existing access governance documentation ahead of scheduled regulatory reviews.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.