PKI-based identity for agentic AI and what it changes

TL;DR: PKI-based identity can secure agentic AI by extending certificate-based trust into AI agent workflows, positioning identity as the control plane for agent access, tool use, and auditability, according to Keyfactor. That matters because agentic systems inherit NHI governance problems unless identity, privilege, and lifecycle controls are designed for runtime behaviour, not just service accounts.

NHIMG editorial — based on content published by Keyfactor: PKI-based identity for securing agentic AI

By the numbers:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
• Only 5.7% of organisations have full visibility into their service accounts.
• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.

Questions worth separating out

Q: How should security teams govern PKI-based identity for AI agents?

A: They should treat certificates as the start of governance, not the finish.

Q: Why do AI agents complicate traditional machine identity controls?

A: AI agents can change actions, choose tools, and continue execution in ways that static workload identities were never designed to describe.

Q: What breaks when certificate lifecycle is not tied to agent workflows?

A: Revocation and rotation lose operational meaning if the certificate is no longer mapped to a specific workflow, delegate, or action path.

Practitioner guidance

• Bind agent certificates to explicit runtime scope Define what each AI agent certificate can access, which tools it may call, and which services sit outside that trust boundary.
• Tie revocation to workflow completion events Revoke or reissue credentials when the agent task, approval context, or delegated objective changes.
• Create certificate-to-action audit chains Record which certificate, which delegation path, and which downstream action were involved in every agent transaction.

What's in the full article

Keyfactor's full blog covers the operational detail this post intentionally leaves for the source:

• How PKI-based identity is applied to agentic AI security workflows in practice
• The vendor's framing of certificate lifecycle requirements for securing AI agents
• Specific platform-oriented use cases for securing AI agents with identity primitives
• The original source context behind Keyfactor's secure AI agent messaging

👉 Read Keyfactor's analysis of PKI-based identity for securing agentic AI →

PKI-based identity for agentic AI and what it changes?

Explore further

View Full Forum →  |  NHI Foundation Course →