PKI identity for agentic AI: what it means for identity teams

TL;DR: AI systems need strong machine identity controls before they can safely interact with tools, services, and data, as Keyfactor’s validation of PKI-based identity for securing agentic AI points to a broader governance problem. The issue is not whether AI can authenticate, but whether identity, privilege, and lifecycle controls can keep pace with runtime autonomy.

NHIMG editorial — based on content published by Keyfactor: PKI-based identity for securing agentic AI

By the numbers:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.

Questions worth separating out

Q: How should security teams govern agentic AI identities with PKI?

A: Security teams should treat agentic AI identities as governed machine identities, not as special exceptions.

Q: Why do agentic AI systems complicate traditional IAM controls?

A: They complicate IAM because runtime behaviour can change after identity is issued.

Q: What breaks when certificates are used without lifecycle governance for AI agents?

A: Certificates become durable trust tokens instead of managed identities.

Practitioner guidance

• Inventory agent identities as first-class NHIs Map every agent, workload, and service account that can invoke tools or access data.
• Bind privilege to task scope, not just identity proof Use certificate-backed identity to authenticate the agent, then enforce narrow authorization rules on the specific services, data sets, and tool calls that agent may reach.
• Operationalise revocation and renewal workflows Define who can revoke agent certificates, what telemetry confirms revocation, and how renewals are approved before expiry.

What's in the full analysis

Keyfactor's full news post covers the operational detail this post intentionally leaves for the source:

• The vendor's product framing for how PKI-based identity is positioned across agentic AI use cases.
• The surrounding platform context for secure AI agents and cryptographic posture management.
• The newsroom wording that ties certificate identity to Keyfactor's broader trust and compliance narrative.

👉 Read Keyfactor’s validation of PKI-based identity for securing agentic AI →

PKI identity for agentic AI: what it means for identity teams?

Explore further

View Full Forum →  |  NHI Foundation Course →