Topic starter
10/07/2026 9:09 pm
TL;DR: AI agents can only be governed if enterprises stop treating them like enhanced scripts and instead apply machine identity, PKI and signed models to establish who they are, what they may do and whether their code is trustworthy, according to eMudhra. Access review cadences, shared secrets and borrowed service accounts do not scale to autonomous actors whose actions must be attributable at runtime.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “Securing AI Agents with Machine Identity, PKI, and Signed Models”.
Key questions
Q: How should security teams govern AI agents that can change actions at runtime?
A: Security teams should govern runtime AI by correlating identity, data, and intent before trusting an action path.
Q: Why do shared service accounts create risk for AI agents?
A: Shared service accounts hide which agent made a request, so they collapse accountability and make incident response slower.
Q: What breaks when AI agents rely on long-lived API keys?
A: Long-lived keys turn a single leaked secret into persistent authority, and agents create more places for that secret to leak through prompts, logs, cache layers, and tool outputs.
Practitioner guidance
- Define a unique identity for each agent Issue per-agent credentials that can be tied to a specific principal, task and lifecycle event instead of reusing shared service accounts or copied secrets.
- Move authorisation to issuance time Scope access at the point the agent is created or activated so the permissions reflect the task, not a generic environment role.
- Bind agent authentication to PKI Use certificate-backed authentication and revocation workflows so agent trust can be renewed, rotated and withdrawn without shared-secret sprawl.
Bottom line: AI agents need distinct machine identities because borrowed credentials obscure who acted and make governance unreliable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
Machine identity is the missing control plane for AI agents: once an organisation treats agents as autonomous actors, borrowed credentials stop being acceptable because they hide who acted and with what authority. Machine identity gives each agent a cryptographically verifiable name, which is the minimum condition for accountability. The practitioner conclusion is simple: if an agent cannot be uniquely identified, it cannot be governed.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between machine identity and signed models for AI agents?
A: Machine identity proves which agent is acting, while signed models prove whether the code or model artifact is trustworthy. Both are needed because a legitimate agent can still execute untrusted code, and a trusted model can still be invoked by the wrong actor.
👉 Read our full editorial: Securing AI agents with machine identity, PKI and signed models