Who Signs Off When an AI Agent Acts? Agentic AI in Government Under OMB, GSA and NIST

An AI agent is a system that takes actions in other systems to reach a goal, choosing its own steps along the way. NIST's Center for AI Standards and Innovation (CAISI) described AI agent systems in a January 2026 request for information as "capable of taking autonomous actions that impact real-world systems or environments."

The Office of Management and Budget (OMB) memo M-25-21 doesn't use the word agent, but its definition of AI "includes systems that are fully autonomous, partially autonomous, and not autonomous," with and without human oversight. It leaves out robotic process automation and other systems "whose behavior is defined only by human-defined rules." A scripted bot that moves files on a schedule is likely outside the memo. An agent that uses a model to decide which file to move, and where, is likely inside it, and the Chief AI Officer's process settles the close cases.

Not by itself. Section 4(a) of M-25-21 says a high-impact determination "is possible whether there is or is not human oversight for the decision or action." What decides it is whether the AI's output "serves as a principal basis for decisions or actions" with a legal, material, binding or significant effect on rights, access to programs or services, safety, critical infrastructure or sensitive assets.

Footnote 27 adds the other side: AI can sit inside a high-impact process without being high-impact if its output doesn't actually serve as a principal basis for the decision. So the honest question about a reviewer is how much they rely on the agent. A caseworker who checks the agent's work against the file is different from one who clicks approve on a summary.

Section 7 matters more for agents than for chat tools. It counts risk whether the AI "merely informs the decision or action, partially automates it, or fully automates it," and whether or not it is apparent that anything happened. An agent triaging a shared inbox makes decisions every time it leaves a message alone. Testing usually covers what the agent did; the risk review has to cover what it didn't do as well.

For uses that are high-impact, the seven minimum practices in Section 4(b) apply (our M-25-21 explainer walks through all of them and the waiver and pilot exemptions). Two read differently for agents. Ongoing monitoring must detect "changes to an AI system after deployment," and for an agent a new tool connection or a rewritten instruction is that kind of change. Practice (v) asks for human oversight, intervention and accountability, plus a fail-safe "when practicable," and footnote 31 accepts that some safety actions have to be immediate and automated while still requiring an oversight and accountability process for them.

GSA's clause 552.239-7001 names agents directly. GSAR 539.71 tells contracting officers to insert it when buying a "Large Language Model (LLM), generative assistant, chatbot, agentic system" or similar system where LLM functionality is a material feature and government data goes to or comes from the model. Paragraph (a)(1)(i) of the clause repeats that list.

Paragraph (f)(4), "Human oversight, intervention, and traceability," is the part agent builders will notice. Where the model uses "intermediary processing (reasoning, retrieval, or agentic steps)," it must make a summary of the steps it records available through the user interface where there is one, a documented API, and an administrative audit trail. To the extent the model performs and records them, the summary covers intermediate actions and decision points, model routing decisions, data retrieval methods including "tool calls, or agent actions," and any human reviewer's access to government data. Paragraph (f)(4)(iii) limits this to "a summary of recorded steps, not a faithful explanation of the model's internal reasoning."

That is useful to agencies even outside GSA contracts, because it describes a record a reviewer or an appeal can use. Whether the clause applies to a particular order is the contracting officer's call; our GSA AI clause explainer covers its scope and the rest of its requirements.

At actions that are hard to reverse, leave the agency, or change someone's status, money or access. Steps that are internal, reversible and easy to check later, such as gathering documents or drafting a response, are reasonable for an agent to do alone.

NIST's proposed tenet on human-in-the-loop triggers frames this as organization-defined "risk thresholds and tolerances" that send an action to "the correct authority for escalated decisions," with enough context for the reviewer to judge it. The same tenet warns about "consent fatigue where human escalation becomes so frequent that agentic actions are approved habitually, rather than through careful risk consideration."

Approval queues tend to fail that way. A reviewer who sees dozens of sound proposals in a row starts approving on sight. Track how often reviewers change or reject what the agent proposes; if that almost never happens, either routine work is being escalated or the review has turned into a formality.

On October 27, 2026, NIST published ten design tenets for agent identity, authentication and authorization, drawn from public comments on its NCCoE agent identity and authorization project. NIST calls them "an initial set" and says "not all of these design tenets will be immediately fulfilled by the current state of standards and technology." The table pairs each one with a question to ask before a pilot.

Tenet 07 explains why: large language models take data and instructions through a single stream, so a prompt injection can't be ruled out inside the model and has to be contained by the architecture around it. "Guardrails alone are insufficient," NIST writes. Its August 27, 2026 post makes the plainer point that people handing their own credentials to agents "has quickly become a common pattern," and calls credential sharing "a bad idea in all contexts." The same post says many of these problems "are not new": most of the work extends identity, privilege and logging practice they already run to a new kind of account.

Start with the action inventory, because every later decision depends on it: each tool and system the agent can call, which actions can be undone, and which ones touch a person's case or leave the agency. That list sets the approval thresholds, tells the Chief AI Officer's process what it is assessing, and gives the security review its boundary.

Next, decide the risk tier on what the agent's actions decide, with footnote 27 in mind rather than the presence of a reviewer, and name the things the agent can decline or leave undone so they get tested too. Give the agent its own identity and short-lived, task-scoped access, never a person's credentials. Keep its records somewhere it can't modify, detailed enough that someone can explain any action to the person who appeals it. If the purchase goes through a GSA vehicle, raise the clause's step summary with the contracting officer early, since it shapes what the vendor has to make available.

Our analytics and AI services page describes how we approach AI governance and engineering for agencies.