{"resourceId":"stanford-aisf-agent-identity-framework-2026","versions":[{"version":"external-ce86b572fabda3f86674537a2be2cddc0b4552d7454627ac7aa13c958a71ef89","resource":{"id":"stanford-aisf-agent-identity-framework-2026","title":"Stanford AISF sets risk-tiered Self-Service/DRA pathways and mandatory agent identity for administrative AI","organization":"Stanford University (University IT)","sector":"Higher education campus IT / information security / administrative AI governance","geography":"United States (Stanford University, California; R1 research university)","publishedAt":"Undated living Stanford UIT AI Security Framework page (retrieved 2026-09-27)","publicationDate":null,"eventDate":null,"sourceName":"Stanford University IT","sourceLabel":"Institutional AI Security Framework for risk-tiered deployment and agent identity","sourceUrl":"https://uit.stanford.edu/security/agenticai/security-framework","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["developers-agents","data-security","governance-procurement","operating-model","infrastructure"],"finding":"Stanford University IT's AI Security Framework (AISF) establishes a risk-based shared-responsibility model for developing, deploying, procuring, and overseeing AI systems that touch Administrative data—including student records, faculty/staff information, financial records, alumni/development data, and research-administration funding. Every in-scope deployment begins with a Self-Service Deployment Checklist; High-Risk systems and non-approved third-party AI also require a Data Risk Assessment. Agents are classified Individual, Internal Workflow, or External-Facing, with lifecycle gates for identity provisioning, least privilege, logging, tested kill-switches, and decommissioning. Section 6 requires every in-scope AI agent to have an identity appropriate to its category; Internal Workflow and External-Facing agents must not run under human user credentials. The document integrates concepts from ISO 42001, NIST AI RMF, EU AI Act, AIUC-1, and OWASP AIVSS, and is framed as guidance rather than a binding policy mandate.","sledRelevance":"Direct campus-operations governance evidence for how a major R1 operationalizes agentic AI security over administrative systems. Why now: never archived; newly relevant complementary institutional framework the day after Vanderbilt's CIO emphasized unresolved agent identity/liability questions in the 2026-09-26 edition.","evidence":"Opened Stanford UIT HTTPS framework page with risk matrices, lifecycle tables, and agent-identity principles. Standards guidance without measured adoption KPIs.","architectureImplications":"Provision distinct non-human identities for internal and external-facing agents; encode Self-Service vs DRA pathway logic into intake tooling; require kill-switch and audit logging before activation; re-classify on tool/API/write-permission expansion.","governanceImplications":"Assign Service/Business Owners for workflow and external agents; treat inaccurate self-certification as an accountability event; keep High-Risk disclosures need-to-know with OGC/Communications review.","securityPrivacyImplications":"Administrative-data scope pulls finance, HR, and student-ops AI into DRA; least-privilege scopes and renewable credentials reduce blast radius of autonomous tool calls.","caveats":"Undated living page; guidance not a policy mandate; no measured outcome metrics; Stanford-specific DRA/ISO capacity may not transfer to smaller campuses.","streamIds":["campus-operations"],"roles":{"sales":"Campus CIO and CISO buyers wrestling with shadow administrative agents need a governable intake path—not another chatbot demo. Stanford's AISF shows a risk-tiered Self-Service versus DRA model that explicitly covers Administrative data and requires distinct agent identities with kill-switches. Bound discovery to how the prospect classifies internal workflow agents touching finance, HR, or student records today. Do not sell \"Stanford compliance,\" guarantee DRA throughput, or claim the framework is a finished policy mandate the page itself says it is not.","engineering":"Architecture fit is a risk-tiered agent registry integrated with identity, DLP, and data-risk assessment—not unmanaged Copilot Studio sprawl. Map Individual agents under user SSO versus Internal Workflow/External-Facing agents under dedicated service identities, tool allowlists, and renewable credentials. Prerequisites include an authoritative administrative-data inventory and a DRA workflow for High-Risk/third-party systems. Constraints: Stanford-specific capacity and undated living guidance. Proof of value is one Internal Workflow agent enrolled with distinct identity, logged actions, and a tested kill-switch—not a slide deck of principles.","delivery":"Delivery stands up AI system intake, category addenda, identity provisioning, monitoring, and decommission runbooks owned by Service/Business Owners with ISO concurrence. Train deployers on accurate self-certification and re-classification triggers when scopes expand. Acceptance criteria should include registered identities for production agents, completed Self-Service or DRA records, and documented kill-switch tests. Primary risks are rubber-stamp self-certification, agents still running under human credentials, and High-Risk third-party tools skipping DRA."},"roleDetails":{"sales":{"customerProblem":"Shadow administrative AI agents access finance/HR/student data without identity, review, or kill-switch controls.","stakeholders":["CIO","CISO","Privacy/UPO","Administrative data owners","Service/business owners"],"discoveryQuestions":["Which production agents act on administrative data today?","Do Internal Workflow agents have distinct non-human identities?","Is there a Self-Service vs high-risk review pathway?","Who owns kill-switch authority?"],"valueHypothesis":"Risk-tiered intake with mandatory agent identity can enable campus AI without a central bottleneck—effectiveness depends on local DRA capacity, not Stanford's label.","potentialEngagement":"Four-week administrative-AI intake design: classify top ten agents, draft Self-Service checklist, and define DRA triggers for High-Risk/third-party tools.","unsupportedClaims":["Guaranteed Stanford-equivalent governance maturity","Policy mandate status for AISF","Measured ROI from the framework alone"]},"engineering":{"fit":"Risk-tiered agent registry with SSO/service identities, DRA for High-Risk/third-party AI, and lifecycle kill-switch controls over administrative data.","architectureIntegration":"Integrate intake forms with IAM for distinct agent identities, DLP/tenant controls, logging, and Data Risk Assessment workflows; default Internal Workflow column for ambiguous internal systems.","prerequisites":["Administrative data classification inventory","Identity platform supporting non-human identities","DRA/privacy review capacity","Acceptable-use training for deployers"],"constraints":["Guidance not a binding policy","Undated living page","R1-scale oversight capacity assumed"],"security":"Distinct, attributable, least-privilege, revocable, renewable agent identities; no long-lived static credentials for Internal Workflow/External-Facing agents; tested kill-switch on file.","proofOfValue":["One Internal Workflow agent with distinct identity and audit trail","Documented Self-Service vs DRA decision for a High-Risk case","Kill-switch test recorded with ISO awareness"]},"delivery":{"work":"Implement AI system records, category addenda, identity provisioning, monitoring/drift review, and decommissioning checklists.","dependencies":["IAM/ISO","Privacy office","Administrative data owners","OGC/Communications for High-Risk disclosures"],"ownership":"Service/Business Owners for workflow and external agents; individual deployers for Individual Agents; CIO/CISO executive accountability.","skillsAdoption":"Train deployers to classify risk tier and agent category accurately; teach operators to treat AI-origin markers and escalation paths as mandatory.","governanceCheckpoints":["Pre-deploy Self-Service or DRA completion","Quarterly access review for workflow/external agents","Re-classification on scope/tool expansion"],"acceptanceCriteria":["Production agents registered with category and owner","Distinct identities for Internal Workflow/External-Facing agents","Kill-switch test evidence on file"],"risks":["Inaccurate self-certification","Agents still using human credentials","Third-party High-Risk tools bypassing DRA"]}},"retrievedAt":"2026-09-27T21:59:00-05:00","enrichedAt":"2026-09-27T21:59:00-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Shared-responsibility self-service aims to avoid bottlenecks that lock less-resourced units out of approved AI; High-Risk equity/bias checks are required mainly at higher tiers.","procurementImplications":"Non-approved third-party AI defaults to DRA; AI features added after initial SaaS procurement are explicitly in scope—contract language should anticipate post-award AI enablement.","operatingModelImplications":"Shifts from ad-hoc shadow agents to registered, owned identities with lifecycle stages; deployers hold first-line accountability while ISO/privacy scale with risk.","sourceVerification":{"openedUrl":"https://uit.stanford.edu/security/agenticai/security-framework","referenceExcerpt":"This framework requires every AI agent, that is in scope under Section 2.2, operating at Stanford to have an identity appropriate to its Agent Category.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}