In partnership with
The National Institute of Standards and Technology finalized IR 8587 on September 15, with the Cybersecurity and Infrastructure Security Agency contributing to the work.
The report is titled Protecting Tokens and Assertions from Forgery, Theft, and Misuse. It gives implementation guidance for federal agencies and cloud service providers.
200+ Proven Ways to Make Money With AI in 2026
The next wave of millionaires will be people who figured out how to make AI work for them.
The window to get ahead is still open. But not for long.
Here are 200+ proven ways to make money with AI in 2026.
Sign up for Superhuman AI, the free daily newsletter read by 1M+ professionals, and get instant access to all 200+ ways to profit from AI this year.
NIST says the document was modified and expanded after public feedback on a December 2025 draft. The final record therefore represents a revision process, not a first proposal.
Identity tokens are small pieces of information that help a service identify a user and authorize access. They can support web email, data backup, single sign-on, federation, and application programming interfaces.
IR 8587 builds on updates to NIST Special Publication 800-53 Release 5.1.1. It organizes implementation considerations around identity providers, authorization servers, consuming agencies, and cloud providers.
The report’s abstract identifies several technical areas. They include key management, token verification, token life cycle controls, architectural choices, and safeguards for single sign-on, federation, and API access.
Key management concerns the creation, storage, use, rotation, and protection of cryptographic keys. Token verification concerns how a receiving service decides whether an assertion is authentic and acceptable.
Life cycle controls cover more than issuing a token. An organization must understand when credentials are created, how long they remain valid, how they are used, and how access is withdrawn.
Because tokens can support multiple services, an architecture review should trace trust across the issuer, authorization server, relying application, and external federation partner. That map identifies where claims are accepted and where revocation information must travel.
Built for Product Teams moving at AI Speed.
Your teams are moving fast, burning tokens, and shipping more than ever.
But more output doesn’t mean more impact.
Jira Product Discovery brings your ideas, customer insights, and business context together so product teams can weigh the evidence, make the tradeoffs, and decide what’s actually worth building. Then connect those decisions directly to delivery in Jira, so everyone knows what you’re building and why.
Jira Product Discovery. For better product decisions in the AI era.
NIST’s news release says the publication includes references to current and emerging standards. It also mentions more options for token revocation and for sharing signals about token status.
Revocation matters when a token must stop working before its normal expiration. A service that cannot act on revocation information may continue trusting an exposed credential during the response window.
The release also adds high-level considerations for artificial intelligence and migration toward post quantum cryptography standards. NIST says the report does not provide a complete toolset for either subject.
That qualification is significant. The document connects token protection with newer technical concerns, but it does not claim to solve AI identity or post quantum migration by itself.
The guidance is aimed first at federal agencies and their cloud providers. NIST says organizations outside government that handle identity tokens and related assertions may also use the implementation considerations.
That broader relevance does not make the report a certification scheme. Reading the document does not prove that an organization’s tokens are protected or that its trust relationships are correctly configured.
The report also does not replace local architecture review. Token flows vary across identity providers, authorization servers, applications, service accounts, and external partners.
The technical question is not only whether a token is encrypted. It is also which system can issue it, which service can accept it, which claims are trusted, and how the organization can stop it.
The final IR 8587 provides a common reference for that review. Its value is in connecting cryptographic protection, token verification, revocation, and architecture rather than treating identity access as a single setting.
It records guidance, not evidence that every current cloud system follows it. The next test is how agencies and providers translate the recommendations into documented token inventories, verification rules, monitoring, and response procedures.
Hire anyone, anywhere — compliant in under 3 days
Found the right hire, but no entity in their country? Remote becomes the legal employer — with contracts, benefits, and tax setup handled, plus direct access to the same in-house team that runs payroll locally.
