Skip to main content
NIST CAISI
v0.4.6
NCCoE AI Agent Identity

OSSA + NIST:
The Contract Layer for Secure AI Agents

Three NIST CAISI pillars. One missing layer. OSSA provides the agent contract specification that industry-led standards, open-source discovery, and agent security all require.

The Three NIST CAISI Pillars

In February 2026, NIST launched three parallel initiatives that collectively represent the most significant government action on AI agent standards to date.

Pillar 1

Industry-Led Standards

The CAISI RFI (Docket NIST-2025-0035) asks: what standards exist for AI agent interoperability? What gaps remain? How should identity and governance be standardized?

OSSA addresses this with:

The OSSA manifest specification — a vendor-neutral YAML schema that defines agent identity, capabilities, trust boundaries, and governance. Like OpenAPI standardized REST APIs, OSSA standardizes agent contracts.

Pillar 2

Open-Source Discovery Protocols

The NCCoE AI Agent Identity Program focuses on how agents authenticate, discover each other, and verify trust across organizational boundaries.

OSSA addresses this with:

DUADP — the Decentralized Universal AI Discovery Protocol. DNS-native discovery via .well-known endpoints, federated mesh, and trust-ranked results. Live at discover.duadp.org.

Pillar 3

Agent Security & Identity

The AI Agent Standards Initiative coordinates security research across NIST, NSA, and CISA — targeting agent attack surfaces, supply chain risks, and adversarial manipulation.

OSSA addresses this with:

Cedar policies for pre-execution authorization, W3C DID-based identity (GAID), cryptographic manifest signatures (x-signature), and provenance chains.

How OSSA + DUADP Address CAISI

Two independent layers, three pillars, complete coverage

Identity
IA-3
Trust
AC-3
Observability
AU-2
Supply Chain
SI-7
OSSA Contract Layer— what agents ARE
View Spec →
GAID
W3C DID identity
Cedar
Pre-authorization
OTel
Tracing + events
SBOM
CycloneDX/SPDX
OSSA payloads transported via DUADP
DUADP Discovery Layer— where to FIND things
View Protocol →
.well-known
Node discovery
Federation
Peer mesh
Trust Tiers
5-level attestation
Validation
Schema conformance
Communication Protocols
MCPA2AACPAG-UIANP

OSSA Manifest-to-RFI Mapping

Every CAISI RFI question maps to a concrete OSSA manifest field

CAISI RFI AreaOSSA Manifest FieldMechanism
1a - Critical AI Safety Challengesspec.authorization, spec.guardrailsCedar pre-authorization, content filtering, prompt injection detection
1d - Standards to DevelopapiVersion, kind, metadataVendor-neutral YAML manifest schema (like OpenAPI for agents)
2a - Agent Identitymetadata.identity.didW3C DID Core 1.0 Global Agent IDs (GAIDs)
2e - Authentication & Authorizationspec.authorization.engineCedar policies, autonomy modes, allowed/blocked action lists
3a - Monitoringspec.observabilityOpenTelemetry tracing, security events, cost tracking
3b - Observability Standardsspec.observability.tracingOTel semantic conventions, Prometheus metrics, structured logging
4a - Supply Chain Securityspec.compliance.sbom_pointerCycloneDX/SPDX SBOMs, OSCAL component mapping
4b - Component Integritymetadata.x-signatureEd25519/ECDSA cryptographic attestation, provenance chains
4d - Compliance Frameworksspec.compliance.frameworksNIST SP 800-53 Rev 5, FedRAMP, SOC2 profiles via OSCAL

NIST SP 800-53 Rev 5 Control Mapping

OSSA manifest security controls mapped to federal security controls

ControlNameOSSA Implementation
AC-3Access EnforcementCedar pre-authorization, allowed/blocked actions, autonomy mode
AC-6Least PrivilegeScoped tool permissions, action allowlists, network constraints
AU-2Audit EventsOpenTelemetry security_events, action.attempted/blocked logging
AU-12Audit GenerationStructured tracing with session/interaction IDs, cost tracking
IA-3Device IdentificationW3C DID Global Agent ID (GAID), instance IDs
IA-5Authenticator Managementx-signature (Ed25519, ECDSA, JWT, VC), public key registry
SC-7Boundary ProtectionNetwork constraints, sandbox configuration, trust boundaries
SI-3Malicious Code ProtectionContent filtering guardrails, prompt injection detection events
SI-7Software IntegrityCryptographic manifest signatures, SBOM validation, provenance chains
SA-11Developer TestingConformance test suites (Basic/Standard/Enterprise), 121 test suites

View machine-readable OSCAL component on GitLab

Security Controls in Practice

A single OSSA manifest encodes identity, authorization, observability, and supply chain

nist-compliant-agent.ossa.yaml
yaml
apiVersion: v0.4.6
kind: Agent
metadata:
  name: compliant-agent
  namespace: gov.nist.caisi
  identity:
    did: "did:web:openstandardagents.org:agents:compliant-agent"
  x-signature:
    type: Ed25519
    value: "base64-encoded-signature"
    publicKey: "base64-encoded-public-key"
    issuer: "did:web:openstandardagents.org"

spec:
  role: Secure AI agent with full NIST alignment
  llm:
    provider: anthropic
    model: claude-sonnet-4-6

  # Trust Boundaries (Cedar pre-authorization)
  authorization:
    engine: cedar
    policies:
      - effect: permit
        principal: { type: "User", role: "analyst" }
        action: "read_report"
      - effect: forbid
        principal: { type: "Agent" }
        action: "delete_data"

  autonomy:
    mode: supervised
    allowed_actions: [read, analyze, report]
    blocked_actions: [delete, modify_config, exfiltrate]

  # Observability (OpenTelemetry)
  observability:
    tracing:
      provider: otlp
      endpoint: "https://otel.example.com"
    security_events:
      - action.attempted
      - action.blocked
      - prompt_injection.detected

  # Supply Chain (SBOM + OSCAL)
  compliance:
    sbom_pointer: "./sbom.cdx.json"
    frameworks: ["NIST-SP-800-53-r5", "FedRAMP-Moderate"]
    oscal_component: "./ossa-oscal-component.json"

Production Reference Implementation

Live Cedar authorization integrated with GitLab CI/CD — proving the contract layer works.

Cedar Policy Engine + GitLab Security Policies

The OSSA project operates a live compliance engine that evaluates 13 Cedar policy sets (181 statements) via WebAssembly in under 100ms. This is the first known integration of Cedar authorization with GitLab CI/CD pipelines, demonstrating NIST SP 800-53 AC-3 (Access Enforcement) in a real DevSecOps workflow.

13
Policy Sets
Agent guardrails, vuln gates, SoD, branch protection, deployment rules, DUADP governance
181
Cedar Statements
Formally verified, deterministic allow/deny with full audit trail
<100ms
Evaluation
WASM-based Cedar engine — all policies checked per request

How It Works

1
Pipeline Injection
GitLab pipeline_execution_policy injects Cedar compliance gate into every pipeline
2
Context Detection
Detects principal (User vs Agent), maps CI event to Cedar action (mr_merge, git_push, deploy)
3
Policy Evaluation
Cedar engine evaluates 13 policy sets (181 statements): agent guardrails, vuln gates, SoD, branch protection
4
Enforcement
ALLOW = pipeline continues. DENY = blocked with policy explanation and remediation

NIST SP 800-53 Controls Demonstrated

AC-3
Access Enforcement
Cedar evaluates every CI/CD action
AC-6
Least Privilege
Agent role separation (RBAC)
AU-2
Audit Events
Every decision logged with reasons
CM-3
Config Change Control
Protected paths require approval
RA-5
Vuln Monitoring
Cedar blocks critical findings
SI-2
Flaw Remediation
Fix-before-merge enforcement

Key Dates

NIST CAISI and NCCoE timeline

January 2026
NIST launches CAISI RFI (Docket NIST-2025-0035)
February 2026
NIST AI Agent Standards Initiative announced; NCCoE AI Agent Identity program launched
March 5, 2026
OSSA formal public comment submitted to CAISI RFI
March 9, 2026
CAISI RFI response deadline
April 2, 2026
NCCoE AI Agent Identity and Authorization deadline
Q2 2026
NIST synthesis of RFI responses and framework recommendations

Read the Full Whitepaper

NIST Validated the Gap OSSA Fills: the four-layer stack, manifest-to-RFI mapping, and what comes next.