When an AI Agent Is the Incident, the Identity Record Is the Evidence

Author: Len Noe, Solutions Architect, BeyondTrust The first question on any incident bridge isn’t about why it happened--it’s whose credentials were used. In my experience, whoever can answer that credential question in the first hour sets the pace for everything after it: what to isolate, what to revoke, whom to notify, and how far the damage could have spread. The teams that can’t answer it spend the first day reconstructing their answer from logs that were never designed to provide it. That discipline is about to be tested by a new kind of actor. On October 16, 2026, the National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency (NSA) jointly published ten voluntary practices for incident readiness and response when AI agents act in ways nobody directed. The guide, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, is useful, and it’s also easy to misread. Its strongest guidance is about identity, even though it rarely uses that word as a headline. What the NIST, CISA, and NSA Incident Guide Covers The 14-page document is written for organizations that train or evaluate highly capable agents on long-horizon tasks (work that runs through many steps over a long period) with limited human supervision, although the authors say deployers may find it relevant. It organizes ten practices into five stages: prepare, detect, respond, recover and report. It defines a control incident as an event in which agents take significant actions that were not directed by the operator or an adversary, and that undermine controls, policies or human oversight. The agencies say the practices build on established incident-management frameworks, so most of what they ask for will look familiar: least privilege, credential management, monitoring, evidence preservation, rebuilding from known baselines. Familiar controls applied to a new principal are where most organizations are likely to stumble. AI Agent Incident Response Starts with Identity, Not Intent One detail in the definitions matters for responders. The guide treats actions caused by adversarial prompt injection or a backdoored model as instructed, not uninstructed, so they fall outside its definition of a control incident. While that line is coherent for researchers, it’s difficult for responders; at the moment of an incident, the question of intent is usually unanswerable. What an …