Agent Record
The unified profile of an individual agent — its scope, behavioral bounds, permissions, computing cost, and certified competence — consolidated into one record per agent, the AI-native equivalent of a human employee's personnel file.
NIST's Center for AI Standards and Innovation is building the security layer of agent identity — unique identification, authentication separated from authorization, least-privilege and task-scoped permissions. This is correct, necessary work, and it is deliberately narrow: NIST's architecture keeps identity, authorization, and auditing as distinct layers because that separation is the right security discipline. It was never trying to answer a different set of questions a business running agents at scale still needs answered: what does this specific agent cost to run, what is it certified competent to do, and has it earned more trust than it started with.
Agent Record answers those questions as a single, consolidated profile per agent — the AI-native equivalent of a human employee's personnel file. Where NIST's layers answer security questions in isolation, an Agent Record answers an operational and economic question as a whole, drawing on the same underlying identity and permission data without collapsing the security separation that data depends on.
The computing-cost dimension is the field with no prior analog in this body of work's vocabulary. Human Premium and Workforce Arbitrage already establish the cost delta between human and agentic execution at the level of a business's overall cost structure; Agent Record applies the same economic lens one level down, to a single agent's own line-item cost, comparable directly to what a human hire performing the equivalent function would cost.
The certification field connects directly to License Grade: an Agent Record's competence entry is not static, and tracks an agent's progression from junior to senior standing as its verified track record within a Task License's certified domain accumulates.
Application
An Agent Record answers an operational and economic question as a whole: if this agent were a hire, what would its job description, its access badge, its salary, and its performance file all say, read together. Its computing-cost field treats an agent's operating cost — compute, API calls, infrastructure consumed — as the direct economic equivalent of a salary line for a human role performing the same function, trackable and comparable the way a business already tracks what a specific role costs to fill. The record is most valuable for agents performing T2 tasks, where individual variance in competence and trust genuinely matters.
Context
An Agent Record does not replace NIST's AI Agent Standards Initiative or its work on agent identity and authorization; it depends on that infrastructure and sits above it. NIST's architecture deliberately separates identity, authorization, and auditing into distinct layers, which is correct security discipline. An Agent Record answers a different, operational question a fragmented security architecture was never designed to answer: what does this specific agent cost, what is it certified competent to do, and has its track record earned it more trust than it started with. A business running dozens of agents across a stack needs this consolidated view for the same reason it needs a personnel file for a human team, even though the underlying security systems tracking access and identity remain correctly separated underneath it.
This term is machine-readable
Any MCP-compatible AI assistant can retrieve the canonical definition of Agent Record at inference time — no training approximation.
Related Terms
In the Log
First used: August 2026
Edition 1 · updated August 2026