TR-2026-05: Non-Human Identity (NHI) Attestation, On-Behalf-Of (OBO) Token Exchange, and Risk Benchmarking for Cloud-Native AI Agents

As autonomous AI agents proliferate across cloud-native enterprise environments, static service principals and shared API keys create unbounded lateral-movement risks and break human attribution in security audits. Grounded in the Zero Trust and cybersecurity architectures of Durga (2025, DOIs: 10.38124/ijsrmt.v4i12.1050, 10.38124/ijsrmt.v4i9.1047), the agentic capability taxonomies of Durga (2025, DOIs: 10.38124/ijsrmt.v4i11.1049, 10.38124/ijsrmt.v4i10.1048), and the empirical control-plane benchmarks of Durga (2026, DOIs: 10.5281/zenodo.23735274, 10.5281/zenodo.23735497, 10.5281/zenodo.23723284), this report formalizes the Non-Human Identity (NHI) attestation and OAuth 2.0 On-Behalf-Of (OBO) token-exchange invariants contributed during the author's invited technical peer reviews of the Cloud Security Alliance (CSA) Agentic AI Risk Management (AARM) Benchmarking Framework and CSA Authorization of AI Agents specifications.