Federal artificial intelligence runs on a single control catalog. Whether the system is a chatbot, a fraud model, or an autonomous agent, the security baseline a federal agency or contractor is measured against is NIST Special Publication 800-53. It is the spine of FISMA authorizations, it underpins FedRAMP, and private-sector security teams adopt it voluntarily as a baseline. So it matters when NIST itself says — in its own filings — that 800-53 was written for information systems generally, and that AI agents need something more.
That "something more" has a name now, and it is not finished. For defense programs standing up agentic AI, the interval between the demand and the standard is where the risk lives.
NIST Is Building Agent-Specific Overlays — and They Aren't Done
In July 2025, NIST's Computer Security Division launched a project called Control Overlays for Securing AI Systems (COSAiS). Its purpose is direct: the project "will develop a series of overlays for securing AI systems using the NIST Special Publication (SP) 800-53 controls." An overlay is a tailored, use-case-specific set of controls layered on top of the baseline — a way of saying for this class of system, these additional controls apply.
COSAiS defines five use cases, and two of them are agents:
- Adapting and Using Generative AI – Assistant / Large Language Model (LLM)
- Using and Fine-Tuning Predictive AI
- Using AI Agent Systems (AI Agents) – Single Agent
- Using AI Agent Systems (AI Agents) – Multi-Agent
- Security Controls for AI Developers
Here is the gap. As of the project's last update — the page reads "Created July 10, 2025, Updated January 08, 2026" — the only overlay NIST has put into draft is an annotated outline for Using and Fine-Tuning Predictive AI. The single-agent and multi-agent overlays, the two that actually cover the autonomous systems defense programs are racing to field, are still upstream in the pipeline. The concept is public; the controls are not.
Why Agents Break a Catalog Built for "Information Systems Generally"
NIST has been unusually plain about why agents are a distinct problem. In its January 2026 Request for Information on the security of AI agents (docket NIST-2025-0035, which drew 937 comments), the Center for AI Standards and Innovation wrote that "AI agent systems are capable of taking autonomous actions that impact real-world systems or environments, and may be susceptible to hijacking, backdoor attacks, and other exploits."
An agent, in NIST's own description, "consist[s] of at least one generative AI model and scaffolding software that equips the model with tools to take a range of discretionary actions" and "can be deployed with little to no human oversight." That is the crux. A chatbot compromised by prompt injection produces a bad answer. An agent compromised by the same class of attack can read untrusted content, invoke a tool, use a credential, and change external state — before anyone reviews it.
The RFI is explicit that this is territory the existing playbook does not fully cover. It focuses "on the novel risks that arise from the use of machine learning models embedded within AI agent systems," and it asks, among its questions, whether "there are ways in which existing cybersecurity best practices may not be appropriate for the security of AI agent systems." It even asks respondents about the state of practice for "undoes, rollbacks, or negations for unwanted actions or trajectories (sequences of actions) of a deployed AI agent system." And it says the quiet part directly: SP 800-53 "provides a glossary of relevant terms and a catalog of security and privacy controls for information systems generally." Generally. Not for systems that plan, delegate, and act.
A control catalog written for information systems that store and process data has to be re-tailored for systems that take actions. That re-tailoring is precisely what COSAiS is — and until the agent overlays ship, "we're compliant with 800-53" is not a complete answer for an agentic deployment.
The Demand-Side Clock Is Moving Faster Than the Standard
On the defense side, the appetite for agentic AI is not waiting for the overlays to finalize. On June 5, 2026, the White House issued National Security Presidential Memorandum NSPM-11, directing the national security enterprise to "responsibly accelerate the use of AI across intelligence and warfighting domains." It sets hard clocks. "Within 90 days of the date of this memorandum, the Secretary of War shall issue an update to DOD Directive 3000.09 on Autonomy in Weapon Systems." And within the same 90 days, the Committee on National Security Systems and OMB "shall issue an appropriate policy for governance of AI use in national security systems, including implementation and reporting requirements" — a policy that should "maximize consistency with AI governance requirements for non-national security systems, such as that in OMB memorandum M-25-21."
Ninety days from June 5 lands in early September 2026. So the demand-side mandate — govern agentic AI in national security systems, on a NIST-aligned baseline — arrives before the standards-side overlay that would tell you exactly which SP 800-53 controls to tailor. NSPM-11 also raises the bar on what "governed" means: its Assurance pillar requires that AI be "reliable, robust, steerable, and controllable," and it defines controllability as "the ability to monitor the operation and outcomes of a system and take corrective action as needed." Its Accountability pillar holds that "commanders, directors, and heads of agencies shall remain responsible and accountable" at every level of command. Those are properties an agent has to demonstrate in the field — not certifications a vendor holds on paper.
The Control That Survives the Gap: Enforce at the Action Boundary
You cannot wait for the overlays and you cannot field ungoverned agents into national security systems. The move that works in the interval is to put governance where the agent's risk actually manifests: at the boundary where the model reads data and takes an action.
A policy decision made at that boundary is a local computation — allow this query, block this prompt, redact this field, write this line to the audit log, negate this action. It doesn't depend on which SP 800-53 overlay is finalized, and it maps cleanly onto the exact controls NIST is asking about: constraining what an agent can touch, and implementing "undoes, rollbacks, or negations for unwanted actions." It is also the control that keeps working when the network doesn't — the same data-boundary architecture that survives disconnected and degraded environments at the tactical edge.
For a program office, three steps put you ahead of the overlay:
- Inventory every agent by action risk. Distinguish agents that only read from agents that can write, transmit, delete, or execute autonomously. The second class is where the overlays — and your risk — will concentrate.
- Put enforcement at the data/action boundary, deterministically. A rule evaluated locally at the point data crosses into the model gives you a control that is auditable and repeatable, independent of the finalized overlay text.
- Map to SP 800-53 families now. If your agent governance already produces control-mapped, tamper-evident evidence, adopting the COSAiS single- and multi-agent overlays becomes a delta — not a from-scratch rebuild — the moment they publish.
The standards will catch up; NIST has said as much and shown the shape of the answer. The programs that win the interval are the ones that treat agent governance as an enforced boundary today, so the overlay, when it lands, is something they map to — not something they scramble to meet.
Containment.AI enforces AI governance policies at the data boundary in real time — monitoring AI sessions, enforcing policy at the point data crosses into the model, and generating the tamper-evident audit evidence reviewers expect. It is the enforcement layer that maps to the controls NIST's agent overlays are being built to require. See how it works for defense →