Why do organisations need pnPKI for some workflows instead of relying on SAML alone?

Why This Matters for Security Teams

pnPKI exists for workflows where identity proof, non-repudiation, and certificate-backed signatures matter more than simple session authentication. saml is designed to federate login and assert attributes across domains, which is useful for access to applications, but it does not create a legally durable signature chain. For filings, contract approval, notarisation, and regulated transaction approval, the evidence must survive audit, dispute, and sometimes court review.

This is where security teams often underestimate the gap. A saml assertion can say who authenticated and when, but it does not typically provide the cryptographic binding, certificate lifecycle, and revocation evidence expected of pnPKI-backed workflows. That difference becomes critical when the business must prove not only that a user was signed in, but that a specific transaction was signed by a validated identity under controlled issuance and revocation processes. The broader NHI problem is that credentials and trust paths are often less visible than teams assume; NHI Mgmt Group notes that only 5.7% of organisations have full visibility into their service accounts in its Ultimate Guide to NHIs, which is a useful warning for any identity system that depends on auditability.

In practice, many security teams encounter signature disputes only after a filing, contract, or regulated approval has already been challenged, rather than through intentional design of the identity workflow.

How It Works in Practice

pnPKI adds a certificate-based trust model that can bind a signer to a private key, a certificate authority chain, and revocation evidence. In a workflow that needs stronger assurance than SAML alone, the system typically issues or references an individual or organisational certificate, validates the signer at the time of issuance, and records the signing event with enough metadata to reconstruct trust later. That makes pnPKI better suited to cases where a reviewer, regulator, or court may need to confirm who signed, what they signed, and whether the key was valid at the time.

By contrast, SAML works best as an authentication and federation layer. It can support single sign-on, step-up access, and attribute release, but it is not a complete digital signature framework. For workflows that need legal effect, teams usually pair SAML with a signing system rather than treat SAML itself as the evidence of signature. Guidance from the FATF Recommendations shows why identity assurance must be matched to the assurance level of the transaction, especially where regulated approvals or traceable authorisation are involved.

• Use SAML for authenticated access to the signing application.
• Use pnPKI to create the cryptographic signature and certificate chain.
• Store revocation, timestamping, and audit records with the signed object.
• Separate approval authority from presentation of identity where policy requires it.
• Align issuance and revocation with certificate governance, not just account lifecycle.

NHIMG research has shown how quickly secrets and trust material can be exposed in practice, including incidents such as the GitHub Action tj-actions Supply Chain Attack, reinforcing that signing workflows need stronger key protection than ordinary session handling. These controls tend to break down when organisations reuse generic SSO for legally binding signing flows because the evidence chain is too weak for later verification.

Common Variations and Edge Cases

Tighter signature controls often increase operational overhead, requiring organisations to balance legal assurance against user friction and certificate management complexity. That tradeoff is real, especially when teams support both low-risk internal approvals and high-assurance external transactions.

Current guidance suggests there is no universal standard for when SAML plus workflow logging is “enough” versus when pnPKI is mandatory. The answer usually depends on jurisdiction, contract language, evidentiary requirements, and the downstream consequences of dispute. Some organisations also use hardware-backed keys, qualified certificates, or remote signing services, while others accept software-based certificates for lower-risk internal approvals. The important distinction is that the signature method must match the assurance claim.

One common edge case is customer-facing systems that begin as ordinary access portals and later evolve into legally significant signing channels. Another is third-party delegation, where a federated login identifies the person but the legal signature must still be issued under an organisation-controlled certificate. For those patterns, pnPKI and SAML are complementary, not interchangeable. The Hugging Face Spaces breach is a reminder that trust boundaries move quickly once automation and external dependencies are involved, so signature governance should be designed for auditability from the start.

Related resources from NHI Mgmt Group

• Should organisations use CLI instead of MCP for some workflows?
• Should organisations use NFC verification instead of OCR document checks?
• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?