AWS publishes X.509 PKI reference architecture for agent identity
Securing AI agent identity with X.509 PKI on AWS
The architecture shows how x509 certificate chains can bind a specific agent instance to delegated user permissions, closing the spoofing gap that plagues token-only agent stacks. Engineers building multi-agent or MCP deployments on AWS can reuse the pattern with EJBCA and OCSP directly. It also gives security teams a concrete baseline to compare against their current agent authentication design.
AWS published a reference architecture on 12 May 2025 (Machine Learning blog) for securing multi-agent AI systems with cryptographic identity. It combines Keyfactor EJBCA as the certificate authority with signed request envelopes, user-signed delegation assertions, and RFC 8693 audience-scoped tokens. Real-time OCSP revocation verifies agent identity across agent-to-agent calls and MCP tool calls. The goal is to prevent request forgery when agents act on behalf of users.
Securing AI agent identity with X.509 PKI on AWS
Learn how to secure multi-agent AI systems with cryptographic identity using Keyfactor EJBCA and AWS services. This reference architecture combines signed request envelopes, user-signed delegation assertions, RFC 8693 audience-scoped tokens, and real-time OCSP revocation to prove agent identity and prevent request forgery across agent-to-agent and MCP tool calls.
