NIST, European telcos converge on identity as foundation for agentic AI

New publications from the National Institute of Standards and Technology (NIST) and two rival European telcos working together argue that the agentic AI ecosystem needs a strong foundation in identity.

Identity increasingly looks like the control plane for agents. Who an agent represents, what authority it has been delegated, and how its actions can be governed: these core identity access management (IAM) questions are “existential” in a world in which network infrastructure underpins critical public and government services.

So says Karsten Thon, senior business architect for Deutsche Telekom, in a blog for Telco Titans covering the company’s collaboration with primary competitor Vodafone on “the trusted agentic AI for access management TM Forum Catalyst proof-of-concept.”

The Catalyst project aims to show how agentic AI can “continuously interpret contractual obligations and automatically translate them into enforceable network access policies,” as a way to cut through dense documentation and ensure practice meets evolving policy.

Steffen Krippner, senior manager for OSS fulfillment at Vodafone, says the proof-of-concept shows that a process that would typically take an engineer multiple weeks of cross-domain, multi-vendor coordination can be completed by an AI agent within a single day.

The Catalyst solution leverages multiple base LLMs, including models from Anthropic and Mistral, to process documents and “build an understanding of how distinct AI models interpret complex texts.” Put simply, it translates legalese into action. Its digital identity management (DIM) layer was built by telecom transformation specialist Tallence, which, according to the post, “views identity as the operational backbone of network AI.”

AI intelligence is only as smart as its governance

Krippner is careful to note that the goal is “governed intelligence,” and that the Catalyst employs four zero trust safeguards before any AI-generated policy goes live: an initial policy dry-run, a human-in-the-loop approval process mandating explicit validation for any high-risk identity changes, a controlled rollout, and negative testing, “deliberately injecting conflicting or incomplete data to expose weaknesses in the AI’s decision-making.”

The project is designed as a repeatable industry blueprint, anchored in TM Forum standards, specifically ODA, the Digital Identity API (TMF720), and Digital Identity Management (TMFC020).

NIST warns of AI that outpaces safeguards

NIST’s paper begins with a concerning observation. Agentic AI, it says, has potential for everything from shopping to software development. “However, early agentic deployments are repeating a familiar pattern: prioritizing feature development and immediate value over security.”

The push to integrate AI into everything brings us to a “novel frontier of security challenges that ‘model-only’ guardrails are not yet fully equipped to solve.” Innovation and deployment are outpacing caution and safeguards, and the problem could end up seeing the snake eat its own tail: “falling back to poor practices – such as credential sharing, relying on static tokens, granting overly broad access, and overusing Human-in-the-Loop approvals – will only resurrect vulnerabilities that the IAM community has spent decades trying to eliminate.”

“While building a fully mature security framework in a fast-moving landscape takes time, reverting to outdated security practices risks eroding the core value AI agents provide.”

The paper covers a range of governance challenges that AI has amplified, such as credential sharing, long-lived API keys or access tokens, “broadly scoped access,” and the risk of constant fatigue for humans serving as Human in the Loop mechanisms.

“The established IAM standards and best practices of today are the foundation upon which we will build the secure and scalable agentic protocols of the future,” NIST says. The institute’s National Cybersecurity Center of Excellence (NCCoE) plans to release a portfolio of resources to support the adoption of IAM standards and best practices for software and AI agents.

Article Topics

AI agents  |  Deutsche Telekom  |  digital identity  |  identity control plane  |  identity governance  |  identity security  |  NCCoE  |  NIST