Public Key Infrastructure (PKI)

A trust chain where root CAs issue certificates to intermediate CAs, which in turn issue leaf certificates to agents and services. This hierarchical delegation enables scalable trust without requiring every agent to directly trust every other agent.

• Root CA: Offline, air-gapped, highest trust anchor
• Issuing CA: Online, issues short-lived agent certificates
• Registration Authority (RA): Vets agent identity before certificate issuance

In agentic systems, a compromised intermediate CA can be selectively revoked without invalidating the entire infrastructure, a critical property for blast radius containment.

The standard format for binding a public key to an agent's identity through a CA's digital signature. Each certificate contains:

• Subject Distinguished Name (DN): Agent's unique identifier
• Subject Alternative Name (SAN): Additional identities like SPIFFE URIs
• Validity Period: Not-before and not-after timestamps
• Key Usage Extensions: Constraints on what the key can do (signing, encryption)

For agentic security, short-lived certificates (minutes to hours) eliminate the need for certificate revocation lists in dynamic environments where agents spin up and down rapidly.

Systems for invalidating certificates before their natural expiration when an agent is compromised or decommissioned:

• Certificate Revocation List (CRL): A periodically published list of revoked certificate serial numbers, signed by the issuing CA
• Online Certificate Status Protocol (OCSP): Real-time revocation status queries, avoiding CRL download overhead
• OCSP Stapling: The server includes a time-stamped OCSP response in the TLS handshake, eliminating client-side OCSP lookups

In agent mesh networks, OCSP stapling is preferred because it preserves agent privacy (the CA doesn't learn which agents are communicating) while providing real-time revocation.

Automated mechanisms for agents to request and obtain certificates without manual intervention:

• ACME (Automated Certificate Management Environment): The protocol behind Let's Encrypt, now adapted for internal PKI with ACME for Enterprise
• SCEP (Simple Certificate Enrollment Protocol): Legacy protocol using challenge passwords for initial authentication
• EST (Enrollment over Secure Transport): Uses existing TLS mutual authentication for certificate issuance, ideal for agents that already possess an initial identity

For agentic systems, EST with initial bootstrap tokens enables zero-touch provisioning where new agents automatically obtain workload identities upon deployment.

An append-only, cryptographically assured public log of all issued certificates, designed to detect mis-issuance by compromised or rogue CAs:

• Log Servers: Maintain Merkle tree-structured ledgers of certificates
• Signed Certificate Timestamps (SCTs): Proof that a certificate has been logged
• Monitors: Continuously scan logs for unauthorized certificates claiming agent identities

In agentic security, CT monitoring provides domain protection by alerting when any CA issues a certificate for an agent's SPIFFE ID or DNS name, enabling rapid detection of CA compromise or impersonation attempts.

The end-to-end governance of cryptographic key material throughout its existence:

• Key Generation: Using hardware entropy sources within HSMs or TPMs, never software-only RNGs
• Key Storage: Private keys never leave the secure enclave; operations occur within the hardware boundary
• Key Rotation: Automated periodic replacement of agent keys with overlap periods to prevent authentication gaps
• Key Destruction: Cryptographic erasure through secure zeroization of HSM memory

For autonomous agents, automated rotation with grace periods ensures that in-flight transactions complete successfully while old keys are phased out, preventing service disruption during security operations.

A mutual authentication protocol where both the client and server present and validate X.509 certificates during the TLS handshake. Unlike standard TLS where only the server proves its identity, mTLS ensures both agents cryptographically verify each other before transmitting data. This is foundational for zero-trust agent mesh networks, eliminating reliance on network perimeter security. Key implementation details include:

• Certificate rotation via automated PKI
• Revocation checking using OCSP stapling
• Cipher suite hardening to prevent downgrade attacks

A dedicated physical or cloud-based computing device that safeguards and manages digital keys for strong authentication and provides hardware-accelerated cryptoprocessing. In PKI for agentic systems, HSMs protect the root of trust by ensuring private keys for Certificate Authorities and high-value agent identities never exist in plaintext in software. Key capabilities include:

• FIPS 140-2 Level 3 tamper-resistant enclosures
• Key generation and signing entirely within the secure boundary
• Audit logging of all key access operations
• Preventing private key exfiltration even if the host OS is fully compromised

A mechanism by which a host authenticates its hardware and software configuration to a remote verifier before being granted access to sensitive resources or joining an agent network. This goes beyond simple certificate presentation by proving the agent is running in a trusted execution environment (TEE) with a known, unmodified software stack. Technologies like Intel SGX and TPM-based attestation generate cryptographic quotes signed by hardware-rooted keys, allowing a relying party to verify:

• The agent's code hash matches a whitelisted version
• The runtime environment has not been tampered with
• No debuggers or memory inspection tools are attached

A hardware-based security paradigm that protects data in use—not just at rest or in transit—by performing computation inside a hardware-based Trusted Execution Environment (TEE). For agent-to-agent communication, this means even the host operating system, hypervisor, or cloud provider cannot inspect the plaintext of inter-agent messages or the private keys used for PKI operations. Key implementations include Intel TDX, AMD SEV-SNP, and ARM CCA. This provides the strongest available guarantee against insider threat and infrastructure compromise in multi-tenant agent deployments.