PKI-based identity for agentic AI: what security teams need

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Keyfactor's blog post: Certificate-backed trust must be designed around runtime agent behaviour rather than static service account assumptions for PKI-based identity for agentic AI.

Why it matters: It matters because IAM, PAM, and NHI teams need identity controls that can govern agent access, tool use, and lifecycle decisions without relying on human-paced review cycles.

Context

PKI-based identity is the use of certificates and public key infrastructure to bind an identity to a cryptographic trust anchor. In agentic AI, that matters because the identity is not just authenticating a system, it is governing what an agent can do while it is acting.

Keyfactor's framing is that agentic AI inherits the same governance problems seen in other non-human identities unless trust, privilege, and auditability are designed for runtime behaviour. The practical question is no longer whether the agent can sign in, but whether its identity model can constrain what it can invoke, when, and under whose authority.

That makes this a governance problem as much as a cryptographic one. If agent identities are handled like ordinary service accounts, the control model will miss the dynamic way agents select tools, request scope, and complete work in a single session.

Key questions

Q: What breaks when agentic AI is governed like a normal application account?

A: Security controls break down because agentic systems do not behave like fixed-function applications. They can choose actions at runtime, combine tools in unexpected ways, and move faster than periodic review cycles. That means static roles, annual recertification, and one-time approvals do not fully describe the risk or contain the behaviour.

Q: How should security teams govern PKI-based identity for AI agents?

A: They should treat certificates as the start of governance, not the finish. The important controls are scoped issuance, short-lived trust, revocation tied to workflow changes, and logging that links each certificate to downstream actions. Without those controls, PKI authenticates the agent but does not contain its authority or explain what it did.

Q: How do teams prove auditability for AI agent access decisions?

A: By logging the approval context, the access decision, and the resulting action as one traceable workflow. If those three elements are separated, you cannot reliably reconstruct who authorised what the agent saw or did. Auditability for agentic access must be built into execution, not added afterward.

Q: When should institutions treat AI agents as identities rather than tools?

A: Institutions should treat AI agents as identities when the agent can authenticate, call APIs, move data, or take action without a person supervising each step. At that point, the agent affects access decisions and must be governed with the same ownership, logging, and revocation discipline as other non-human identities.

Technical breakdown

How PKI becomes an identity control plane for agents

PKI-based identity gives an agent a verifiable cryptographic identity that can be bound to policies, certificates, and audit records. In practice, that shifts trust from passwords or shared tokens to asymmetric keys and issued certificates, which can carry provenance and lifecycle boundaries. For agentic systems, the key issue is not just authentication but whether the identity layer can express who the agent is, what it may access, and how that access is revoked when the task ends. Without that binding, agent access becomes difficult to distinguish from ordinary machine connectivity.

Practical implication: Treat certificate issuance, renewal, and revocation as the policy boundary for agent access, not as a back-end implementation detail.

Why static service-account assumptions fail for agentic AI

Service accounts were built for predictable, bounded machine behaviour. Agentic AI changes that assumption because runtime decisions can change the path, timing, and scope of access inside the same session. That means least privilege at provisioning time is only part of the picture, because the agent may select tools or invoke downstream services in ways that were not fixed in advance. The governance gap is not just privilege size, but privilege shape over time.

Practical implication: Model agent identity around dynamic authorisation paths and session-scoped constraints rather than inherited service-account patterns.

What auditability requires when the actor is an AI agent

Auditability for agentic AI depends on more than logging the fact that a certificate was used. Teams need to understand which identity issued the request, which tool was selected, which policy path approved it, and whether the action can be traced to a bounded task. PKI can support that traceability, but only if the surrounding governance records link identity, privilege, and execution context. Without that linkage, post-incident review will see a certificate event, not a defensible decision chain.

Practical implication: Design logging and certificate metadata so every agent action can be tied back to task scope, policy decision, and revocation state.

NHI Mgmt Group analysis

PKI-based identity is only useful for agentic AI when it is treated as runtime governance, not just authentication. Certificates can prove an agent's identity, but they do not by themselves explain what the agent was allowed to do or why it was permitted at that moment. The security value comes from binding issuance, policy, and revocation to the agent's operating context, which is the control plane IAM teams need to mature.

Access review processes assume access persists long enough to be reviewed; autonomous agents can complete work before that review window exists. That assumption was designed for human and static machine patterns, not for actors that can request, use, and release authority inside a single task. The implication is that governance needs to move toward issuance-time control and event-linked auditability.

Agentic AI should be governed as a distinct non-human identity class, not as a renamed service account. The article's core idea is that runtime behaviour changes the identity problem, even when the trust technology is familiar. That means NHI programmes must separate static machine identity patterns from agent behaviour that can alter execution paths mid-session.

PKI creates the trust anchor, but the governance failure occurs when organisations stop at cryptography and ignore privilege dynamics. A certificate can identify an agent cleanly and still leave tool use, delegated scope, and revocation timing under-governed. Practitioners should therefore measure whether their certificate model actually constrains agent behaviour, not just whether it authenticates successfully.

Ephemeral agent authority is the named control gap this topic exposes. Agentic systems can acquire authority, use it, and terminate it before traditional review or recertification loops notice the event. That breaks the assumption that identity controls can observe stable privilege over time, and it forces identity teams to redesign governance around task boundaries rather than account lifetimes.

From our research library:

• 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
• Read next: Agentic AI Identity Guide

What this signals

Ephemeral agent authority: Agentic AI makes issuance-time control more important than access-review cadence because authority can appear and disappear inside a single session. That changes how IAM teams think about evidence, since the relevant artefact is the policy decision at runtime, not the existence of a standing account.

Certificate-based identity can strengthen traceability for agents, but only if the programme also records policy context and revocation state. Without that linkage, PKI improves authentication while leaving authorisation drift and delegated tool use poorly governed.

For practitioners

• Define agent identity as a certificate-bound runtime subject Issue identities to agents only when they are tied to a task, policy, and explicit certificate lifecycle so the agent's authority is time and scope bounded.
• Separate agent policy from service-account policy Inventory any AI agent that currently inherits a standard machine account pattern and rewrite its authorisation model around task-scoped access and bounded tool use.
• Bind audit records to execution context Ensure logs capture which certificate was used, which tool was invoked, which policy allowed it, and when the authority was revoked.
• Test for review-window collapse Check whether your recertification and access review cycles can ever see an agent privilege that was created and consumed within one session.

Key takeaways

• PKI can give agentic AI a verifiable trust anchor, but the real control problem is whether that identity is constrained at runtime.
• The article's central tension is that agent behaviour changes too quickly for human-paced review models to govern reliably.
• Practitioners should align certificate lifecycle, task scope, and audit logging so the identity model matches autonomous execution, not static machine access.

Key terms

• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent, covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
• Certificate-Bound Identity: An identity that is tied to a cryptographic certificate instead of a shared secret or password. In agentic environments, this makes the actor traceable and revocable, but only if issuance, renewal, and revocation are aligned to task scope.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Ephemeral Agent Identity: An AI agent identity that exists only for the duration of a specific task or session and is automatically destroyed upon completion. Ephemeral identities are the gold standard for agentic security, they eliminate persistent credential theft risk.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.