Topic starter
25/06/2026 12:18 am
TL;DR: PKI-based identity can secure agentic AI by extending certificate-based trust into AI agent workflows, positioning identity as the control plane for agent access, tool use, and auditability, according to Keyfactor. That matters because agentic systems inherit NHI governance problems unless identity, privilege, and lifecycle controls are designed for runtime behaviour, not just service accounts.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Keyfactor Validates PKI-Based Identity for Securing Agentic AI”.
Key questions
Q: What breaks when agentic AI is governed like a normal application account?
A: Security controls break down because agentic systems do not behave like fixed-function applications.
Q: How should security teams govern PKI-based identity for AI agents?
A: They should treat certificates as the start of governance, not the finish.
Q: How do teams prove auditability for AI agent access decisions?
A: By logging the approval context, the access decision, and the resulting action as one traceable workflow.
Practitioner guidance
- Define agent identity as a certificate-bound runtime subject Issue identities to agents only when they are tied to a task, policy, and explicit certificate lifecycle so the agent's authority is time and scope bounded.
- Separate agent policy from service-account policy Inventory any AI agent that currently inherits a standard machine account pattern and rewrite its authorisation model around task-scoped access and bounded tool use.
- Bind audit records to execution context Ensure logs capture which certificate was used, which tool was invoked, which policy allowed it, and when the authority was revoked.
Bottom line: PKI can give agentic AI a verifiable trust anchor, but the real control problem is whether that identity is constrained at runtime.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:11 am
PKI-based identity is only useful for agentic AI when it is treated as runtime governance, not just authentication. Certificates can prove an agent's identity, but they do not by themselves explain what the agent was allowed to do or why it was permitted at that moment. The security value comes from binding issuance, policy, and revocation to the agent's operating context, which is the control plane IAM teams need to mature.
A few things that frame the scale:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: When should institutions treat AI agents as identities rather than tools?
A: Institutions should treat AI agents as identities when the agent can authenticate, call APIs, move data, or take action without a person supervising each step. At that point, the agent affects access decisions and must be governed with the same ownership, logging, and revocation discipline as other non-human identities.
👉 Read our full editorial: PKI-based identity for agentic AI: what security teams need