<p>As AI agents increasingly manage sensitive business operations, databases, and external APIs, the industry is shifting toward more rigorous security frameworks. To address the risks of unauthorized tool invocation and credential impersonation, AWS and Keyfactor have collaborated on a reference architecture that secures AI agent identity using X.509 public key infrastructure (PKI).</p><h2>The identity gap in multi-agent systems</h2><p>Modern AI frameworks often use the Model Context Protocol (MCP) to enable large language models (LLMs) to interact with external data and tools. Because MCP is transport-agnostic and lacks built-in authentication, it creates potential vulnerabilities where components could perform unauthorized actions. Traditional methods, such as sharing API keys or passing OAuth tokens, fail to meet the zero-trust standards required for enterprise environments.</p><p>To close this gap, the joint AWS and Keyfactor architecture integrates Keyfactor's EJBCA enterprise PKI platform with AWS managed services, including Amazon Bedrock and AWS Secrets Manager. The system establishes a verifiable, revocable cryptographic identity for every agent.</p><h2>Four pillars of the security architecture</h2><p>The solution relies on four key mechanisms to maintain a secure trust boundary:</p><ul><li><b>Signed request envelopes:</b> Every inter-agent call includes a payload signed with a private key, providing cryptographic proof-of-possession and preventing unauthorized replays.</li><li><b>User-signed delegation assertions:</b> Agents are granted authority through specific, time-bound delegations, allowing them to act on a user's behalf without requiring the user to share their actual credentials.</li><li><b>RFC 8693 audience-scoped tokens:</b> These tokens restrict the scope of access to specific services, ensuring that any inadvertent disclosure does not compromise the entire system.</li><li><b>Real-time OCSP validation:</b> Online Certificate Status Protocol (OCSP) checking ensures that if a certificate is revoked, the system propagates this change immediately across all agents.</li></ul><h2>Infrastructure and management</h2><p>The architecture separates trust boundaries between the human user, the agents, and the MCP tool server. By generating and storing RSA keys locally and utilizing certificate-based authentication, the system ensures that private keys are never transmitted or shared. This approach enables a "revocation cascade," where revoking a single user certificate at the PKI layer promptly invalidates all downstream agent permissions.</p><p>This framework is designed to be framework-agnostic, meaning the security patterns can be applied to various multi-agent platforms beyond the AWS Strands Agents SDK, such as LangChain or CrewAI. For enterprises, the architecture provides an auditable, governed approach to AI deployment, connecting LLM capabilities with hardened cryptographic identity management.</p>
Source: aws.amazon.com
Original article: https://aws.amazon.com/blogs/machine-learning/securing-ai-agent-identity-with-x-509-pki-on-aws/
