Topic starter
25/06/2026 12:18 am
TL;DR: PKI-based identity can give agentic AI a verifiable trust anchor when certificate-based trust is extended into agent workflows, according to Keyfactor. Agent governance then depends on runtime limits, because static review cycles do not reliably contain changing tool use or access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Keyfactor Validates PKI-Based Identity for Securing Agentic AI”.
Key questions
Q: How should security teams govern PKI-based identity for AI agents?
A: They should treat certificates as the start of governance, not the finish.
Q: How do teams prove auditability for AI agent access decisions?
A: By logging the approval context, the access decision, and the resulting action as one traceable workflow.
Q: What breaks when agentic AI is governed like a normal application account?
A: Security controls break down because agentic systems do not behave like fixed-function applications.
Practitioner guidance
- Define agent identity as a certificate-bound runtime subject Issue identities to agents only when they are tied to a task, policy, and explicit certificate lifecycle so the agent's authority is time and scope bounded.
- Separate agent policy from service-account policy Inventory any AI agent that currently inherits a standard machine account pattern and rewrite its authorisation model around task-scoped access and bounded tool use.
- Bind audit records to execution context Ensure logs capture which certificate was used, which tool was invoked, which policy allowed it, and when the authority was revoked.
Bottom line: PKI can give agentic AI a verifiable trust anchor, but the real control problem is whether that identity is constrained at runtime.
Glossary terms: Agentic AI Identity, Certificate-Bound Identity, Runtime Authorisation, Ephemeral Agent Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 9:11 am
PKI-based identity is only useful for agentic AI when it is treated as runtime governance, not just authentication. Certificates can prove an agent's identity, but they do not by themselves explain what the agent was allowed to do or why it was permitted at that moment. The security value comes from binding issuance, policy, and revocation to the agent's operating context, which is the control plane IAM teams need to mature.
A few things that frame the scale:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: When should institutions treat AI agents as identities rather than tools?
A: Institutions should treat AI agents as identities when the agent can authenticate, call APIs, move data, or take action without a person supervising each step. At that point, the agent affects access decisions and must be governed with the same ownership, logging, and revocation discipline as other non-human identities.
👉 Read our full editorial: PKI-based identity for agentic AI: what security teams need