Notifications
Clear all
Topic starter
10/07/2026 9:09 pm
TL;DR: AI agents can only be governed if enterprises stop treating them like enhanced scripts and instead apply machine identity, PKI and signed models to establish who they are, what they may do and whether their code is trustworthy, according to eMudhra. Access review cadences, shared secrets and borrowed service accounts do not scale to autonomous actors whose actions must be attributable at runtime.
NHIMG editorial — based on content published by eMudhra: securing AI agents with machine identity, PKI and signed models
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should security teams govern AI agents that use shared service accounts today?
A: Treat shared service accounts as a transitional risk, not an acceptable steady state.
Q: Why do AI agents need machine identity instead of only API keys?
A: API keys identify access, not a specific acting entity, and they are hard to attribute when several agents or workflows share them.
Q: What do security teams get wrong about signed models and agent trust?
A: They often assume that authenticating the agent is enough.
Practitioner guidance
- Eliminate shared agent secrets Assign each AI agent a distinct cryptographic identity so actions can be attributed, scoped and revoked without affecting unrelated services.
- Automate certificate lifecycle operations Use short-lived certificates, renewal automation and revocation workflows so agent trust does not depend on manually managed API keys or environment variables.
- Verify model provenance before execution Gate deployment and inference on signature validation so the platform can reject tampered or substituted model artefacts.
What's in the full article
eMudhra's full article covers the operational detail this post intentionally leaves for the source:
- How the certificate lifecycle is automated for thousands of short-lived agent identities.
- How emCA, CertiNext and SecurePass are positioned in the trust architecture described by the source.
- How signed model verification is applied before deployment or inference in practice.
- How the article ties machine identity to auditability, provenance and revocation workflows.
👉 Read eMudhra's analysis of machine identity, PKI and signed models for AI agents →
AI agent identity and trust controls: what IAM teams need now?
Explore further
10/07/2026 9:32 pm
AI agent governance fails when organisations treat runtime autonomy like a normal service account problem. Shared secrets, borrowed logins and manual approval flows were designed for predictable, human-paced access patterns. That assumption breaks when an agent can initiate actions, select tools and operate at machine speed. The implication is that access governance must be redesigned around the actor, not just the workload.
A few things that frame the scale:
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data and revealing access credentials.
A question worth separating out:
Q: How do certificate-based controls change NHI governance for AI agents?
A: They make identity lifecycle management operational instead of theoretical. Certificates can be issued at creation, rotated on schedule and revoked immediately when an agent is retired or compromised. That creates a governance model that is much closer to how autonomous systems actually behave than long-lived secrets and manual approvals do.
👉 Read our full editorial: Securing AI agents with machine identity, PKI and signed models
