Topic starter
25/06/2026 2:41 pm
TL;DR: Static API keys and passwords do not provide verifiable identity for autonomous AI agents, so enterprise trust shifts toward certificate-backed identity, mTLS, and lifecycle automation according to Keyfactor and Gartner research. The governance question is no longer whether AI can act, but whether each action can be cryptographically attributed and constrained before it scales beyond human review.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “3 Things to Know About Keyfactor’s PKI-Based Identity for Agentic AI”.
Key questions
Q: What breaks when AI agents rely on long-lived API keys?
A: Long-lived keys turn a single leaked secret into persistent authority, and agents create more places for that secret to leak through prompts, logs, cache layers, and tool outputs.
Q: Why do certificate-bound controls reduce risk for autonomous AI agents?
A: Certificate-bound controls reduce risk because they tie access to a specific workload identity rather than to a reusable bearer secret.
Q: How do organisations know if AI identity governance is working?
A: They should be able to answer three questions quickly: which agents exist, which credentials each one uses, and who is accountable for each identity’s lifecycle.
Practitioner guidance
- Define agent identity at issuance Assign each AI agent a unique certificate-backed identity before it can access enterprise systems, and prohibit shared bearer credentials for autonomous workloads.
- Bind access to certificate policy Use certificate extensions and certificate-bound OAuth flows to encode which services an agent may call, which actions it may take, and under what conditions.
- Enforce mutual TLS on agent traffic Require mutual authentication for agent-to-service and agent-to-agent communication so both endpoints prove identity before data exchange.
Bottom line: Agentic AI changes the identity problem from authenticating users to governing autonomous workloads that act on their own.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:48 pm
PKI-backed identity is becoming the governance baseline for agentic AI. Autonomous agents do not fit neatly into human authentication models because their actions are machine-paced and often continuous. When the enterprise needs to know which agent acted, static credentials are an attribution failure, not a convenience. The implication is that AI governance now depends on issuance, binding, and revocation discipline for non-human actors.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should teams move from human-style authentication to workload identity for AI agents?
A: They should do it as soon as an agent can act independently, call tools, or access sensitive systems without a human approving each step. At that point, MFA and password habits stop being the right control model, because the subject is a workload, not a person.
👉 Read our full editorial: PKI-based identity for agentic AI is changing enterprise trust