Identification, Authentication, and Delegated Authority for Non-Person Actors in AI Systems

Evidence controls under consideration for AI-system overlays of NIST SP 800-53 Rev. 5 (AC-16, AU-3, AU-10, AU-12, and SA-8(22)) presuppose a binding between an action and an actor, yet no IA-family control on current candidate lists defines how a non-person actor obtains an authenticated identity. Non-repudiation asserted over a self-asserted subject is a control with no testable assertion in it. This paper proposes overlay tailoring for IA-9 (Service Identification and Authentication) comprising four elements: issuance independence; credential lifetime and re-attestation; authority scope binding; and delegation chain termination in an accountable human or organizational authority. Each element is drafted with its SP 800-53A assessment objective and examine/interview/test procedures. The language names verifiability and issuance independence as distinct requirements, and treats delegated authority on the model of mature financial-services practice: limits cascade, sub-delegation is explicit, and every level expires. All mechanism descriptions are implementation-generic; the text is contributed without restriction for public standards consideration.