Why AI Agent Security Guidance Will Fail Without Addressing Organizational Reality: A Deployer and Developer's Perspective on Enterprise Compliance and AI Agents

This document contains a public comment submitted to the National Institute of Standards and Technology (NIST) Center for AI Standards and Innovation (CAISI) in response to the Request for Information regarding security considerations for artificial intelligence agents (NIST-2025-0035). Tracking number: mmd-tqco-uv2k. The submission draws on 25 years of engineering leadership across eight organizations (Microsoft, AT&T, T-Mobile, Expedia Group, Hitachi Consulting, and others) spanning seven industries and compliance regimes including SOC 2, PCI DSS, HIPAA, COPPA, FERPA, FCC regulations, and ITAR/EAR export controls, combined with daily hands-on use of AI coding agents in production. The comment makes three interconnected arguments. First, NIST guidance on AI agent security must account for the organizational reality of who implements it, as enterprise compliance governance was already eroding before AI agents arrived. Second, NIST's highest-value contribution would be to drive convergence across existing standards rather than adding another layer to an already fragmented landscape. Third, even unified standards will fail if compliance cannot operate at AI speed, requiring machine-readable, automatable governance that runs alongside agents rather than behind them. The submission includes case studies from eight organizations illustrating how compliance governance erodes across different organizational structures, five specific policy recommendations, and analysis of the audit trail crisis created by autonomous AI agents. This document is provided here for archival and reference purposes.