A 2026 enterprise contracting for a third-party AI agent platform is, in almost every case, accepting a vendor-issued non-human identity into its environment with the authority to read, write, transact, and call further agents. Standard 2026 agentic AI master service agreements govern data classes, SLAs, pricing, and exit terms but do not govern the identity primitive the vendor uses for the agent's credentials, the rotation cadence, the customer's right to inventory and audit them, or the vendor's disclosure obligations if a credential class is compromised on the vendor side. The four procurement clauses that close the gap (identity primitive disclosure, rotation cadence and audit right, vendor-side breach disclosure, customer-side revocation control) are absent from the standard MSA templates of every major agentic AI platform reviewed in early 2026 and are present only in customer-redlined versions used by procurement-mature enterprises.

Claim is scoped to the procurement-side instrument for the vendor-issued NHI problem in 2026 agentic AI MSAs. Does not assert that vendors are negligent — most have technically defensible identity practices documented outside the contract. Asserts that the contract layer does not formalise the customer's rights. 60-day review cadence calibrated to procurement cycles. Trigger conditions: (1) any major agentic AI platform publishes a default MSA covering all four clauses — would move toward Partial because the procurement gap is closing structurally rather than per-contract; (2) the OWASP NHI Top 10 or NIST CSF 2.0 publish a vendor-NHI-specific control set — would harden the operational argument and pressure standard MSAs to follow; (3) a published 2026 enterprise breach traceable to a vendor-issued AI agent credential — would either confirm the structural risk or, if the post-mortem points elsewhere, would scope the claim more narrowly; (4) emergence of an enterprise IAM vendor offering that brokers vendor-issued AI agent credentials with the four-clause control set as defaults — would change the operational shape of the customer-side fix.