PKI for AI is the use of public key infrastructure to establish and verify trust for AI systems, agents, and related automation. It applies certificate-based identity, cryptographic assurance, and lifecycle control to AI interactions so organisations can govern who or what is allowed to act.
Expanded Definition
PKI for AI extends certificate-based trust to AI systems, agents, model endpoints, and the automation that acts on their behalf. Rather than treating an AI workflow as a generic application, it assigns cryptographic identity to components that need to prove who they are, where they came from, and whether they are still authorised to operate. In practice, this means using issuance, renewal, revocation, and policy enforcement to control AI-to-AI and service-to-service trust, especially when agents call tools or exchange data through orchestration layers. Guidance varies across vendors on whether PKI for AI should cover only machine identities or also model artefacts, signed prompts, and agent execution contexts. The most defensible interpretation is to anchor it in established PKI principles and map those controls into AI-specific trust boundaries, as reflected in the NIST Cybersecurity Framework 2.0 and related identity governance practices. The most common misapplication is using a certificate to authenticate the host while leaving the agent’s tool permissions and runtime identity unbound, which occurs when teams assume infrastructure trust automatically covers AI behaviour.
Examples and Use Cases
Implementing PKI for AI rigorously often introduces certificate lifecycle overhead, requiring organisations to weigh stronger trust guarantees against operational complexity across fast-changing AI services.
- An internal agent signs outbound requests to retrieval systems so downstream services can verify the request came from an approved automation path, not a spoofed client.
- A model-serving pipeline uses short-lived certificates to authenticate deployment stages, reducing the chance that a compromised build system can silently swap model artefacts.
- Certificate pinning and mutual TLS help constrain AI-to-tool communications when agents invoke privileged APIs or sensitive business systems.
- Revocation policies are used to disable a compromised agent identity quickly, limiting damage when keys, tokens, or service credentials are exposed.
- The DeepSeek breach illustrates why identity and trust controls matter when AI environments expose sensitive records, credentials, or backend access paths.
In standards terms, PKI for AI is most often implemented through established transport and service identity patterns such as mutual authentication, certificate rotation, and trust anchor management, alongside AI governance controls described by NIST and operational guidance used in modern zero trust architectures. It is especially relevant where AI agents must prove identity before they are allowed to transact with other systems or retrieve protected context.
Why It Matters in NHI Security
PKI for AI matters because AI systems increasingly behave like privileged non-human identities: they authenticate, request resources, and trigger actions at machine speed. Without cryptographic identity, organisations cannot reliably distinguish an authorised agent from a copied workflow, a replayed request, or a compromised automation path. That creates direct exposure for secret leakage, tool abuse, and lateral movement across AI-integrated environments. NHIMG research shows how quickly exposed credentials can be abused, with attackers attempting access within an average of 17 minutes in some cases, which makes identity binding and certificate-based containment critical when AI workloads depend on secrets or API keys. The same trust gap appears when teams scale AI faster than governance, because lifecycle controls often lag behind deployment velocity. PKI for AI is therefore not just a deployment detail but a control plane for trust, auditability, and revocation. Organisations typically encounter certificate failure, impersonation, or agent misuse only after an incident or a suspicious tool call, at which point PKI for AI becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | PKI for AI underpins non-human identity trust and certificate-backed authentication. |
| NIST CSF 2.0 | PR.AA-1 | Identity proofing and authentication are core to verifying AI system trust. |
| NIST Zero Trust (SP 800-207) | Zero trust requires strong, continuous identity verification for machine actors. | |
| NIST SP 800-63 | AAL2 | Assurance levels help calibrate how strongly an AI identity must be verified. |
| OWASP Agentic AI Top 10 | A1 | Agentic systems need identity and authorization controls to prevent tool misuse. |
Use certificates and lifecycle controls to authenticate AI services before tool access.
