Agentic Identity
Architecture for
Zero Trust AI
AI agents are the largest unseen workforce inside your critical systems — and your identity controls were never designed for them. This is the complete architecture for securing AI agent identity through SPIFFE/SPIRE, mTLS, policy-as-code, and lifecycle governance across the full agentic stack.
Your AI Agents Have No Identity. That Is a Security Emergency.
// THE FIRST RULE OF 2026 SECURITY: An agent should never possess a credential at rest.
// Instead of giving an agent a key, you give it a verifiable identity.
// Stop creating IAM users for bots. Stop hardcoding API keys. Stop trusting long-lived secrets.
// The “insider threat” is no longer a human. It’s the agent.py file you committed three years ago.
In October 2024, the Internet Archive suffered a catastrophic breach — not from a zero-day exploit, but from a GitLab authentication token hardcoded in a configuration file in December 2022. For nearly two years, that non-human identity sat dormant, unrotated, and fully privileged. When attackers found it, they had the keys to the kingdom. This is the threat model for agentic AI: static credentials issued once, forgotten, and eventually exploited — now at machine speed.
Non-human identities (NHIs) now outnumber human identities in enterprise environments by ratios of 40:1 to 144:1. Every AI agent you deploy adds to this population. Unlike service accounts, agents dynamically select actions from available capabilities and are far more likely than humans to execute dangerous operations when given the opportunity. The result, observed across enterprise deployments in 2025–2026, is agents accumulating standing access to sensitive systems with no tie back to a human identity, no audit trail, and no lifecycle management.
The architecture that solves this is not new — it is the zero trust model applied to microservices and cloud-native workloads, now extended to AI agents as first-class identity principals. SPIFFE is the standard. SPIRE is the implementation. mTLS is the transport. Policy-as-Code is the authorisation layer. Together, they constitute an Agentic Identity Architecture that answers three critical questions for every agent action: Who (SPIFFE ID), What (Zero Trust Policies), and When (Real-Time Attestation).
The Complete Agentic Identity Stack
The architecture operates across four functional layers — each addressing a distinct aspect of the agentic identity problem, from cryptographic identity issuance through runtime policy enforcement to telemetry and audit.
Each Layer: How It Works and Why It Matters
SPIFFE Specification & SPIRE Server
SPIFFE solves the “Secret Zero” problem: how do you securely deliver the first credential to a workload without another, deeper secret underneath it? SPIFFE’s answer is attestation — verifying that a workload is genuinely what it claims to be, based on platform-level evidence that cannot be forged. There are no passwords in this model. The identity is the compute environment itself.
Each AI agent receives a SPIFFE ID — a URI structured as spiffe://trust-domain/agent/type — cryptographically verifiable and tied to runtime workload attributes. The SPIRE Server is the signing authority: it maintains a workload registry, runs attestation plugins, and issues short-lived SVIDs in X.509 or JWT format. SPIRE Agents run on each node, caching SVIDs locally and performing kernel-level workload attestation without network calls.
Security properties are explicitly designed for agentic workloads: identities are ephemeral (typically 1–4 hour TTL), automatic (no human touches a credential), and tied to observable runtime state (binary hash, container image, K8s namespace, service account). When the agent dies, the identity dies. If an agent is compromised, the SVID auto-expires before the attacker can reuse it at scale.
# SPIFFE URI for an AI agent workload spiffe://workload.identity/ns/ai-ops/sa/frame-coordinator # Embedded in X.509 SAN field — any TLS library can read it X509v3 Subject Alternative Name: URI:spiffe://workload.identity/ns/ai-ops/sa/frame-coordinator # SPIRE entry — node + workload attestation selectors spire-server entry create -parentID spiffe://workload.identity/node/k8s-node-01 -spiffeID spiffe://workload.identity/ns/ai-ops/sa/frame -selector k8s:ns:ai-ops -selector k8s:sa:frame-coordinator -ttl 3600 # 1-hour SVID — no secret ever at rest
mTLS, Mutual Authentication & Policy Enforcement
Zero Trust (NIST 800-207) operates on one principle: never trust, always verify — regardless of network location. For AI agents, this means every agent-to-agent and agent-to-tool interaction must be mutually authenticated, encrypted, and authorised against explicit policy before any action executes.
mTLS (Mutual TLS) is the transport mechanism. Unlike standard TLS where only the server presents a certificate, mTLS requires both parties to present and validate each other’s SVIDs. The SPIFFE ID extracted from each certificate tells the Policy Enforcement Point exactly which agent is making the request — enabling fine-grained policy decisions based on workload identity, not network position.
Red Hat’s zero trust agentic AI research identifies the transaction boundary problem as critical: in a multi-hop chain (Client A → Agent B → Tool C), authentication happens between A and B, and separately between B and C. But A’s real transaction depends on B+C acting together. Token exchange — where B swaps A’s token for a scoped, short-lived token for C — makes trust across hops explicit, constrained, and auditable. No blanket tokens that work everywhere.
Human Operators, Policy Engine & Agent Lifecycle
The governance control plane is where human operators exercise authority over the agent fleet. Agents must be registered, assigned identities, granted permissions, promoted through autonomy levels, and decommissioned — all through a governed process with explicit human approval at defined thresholds.
The Cloud Security Alliance’s Agentic Trust Framework (ATF, February 2026) provides the operational model: agents progress from “Intern” (read-only) through “Junior” (human-approved actions) to “Senior” (autonomous within policy scope) based on demonstrated accuracy, security audits, and explicit stakeholder sign-off. Each stage maps to a registered SPIRE entry and a corresponding OPA policy bundle.
Policy-as-Code makes governance scalable: rather than manually configuring permissions on each service, teams write Rego policies expressing the permission model as version-controlled, testable code. Every agent permission is a policy assertion — reviewed, merged, and deployed through CI/CD with the full auditability of source control. Kill switch: immediate SPIRE SVID revocation halts any agent fleet-wide in seconds.
Telemetry, Risk Analytics & Audit Trails
The audit layer produces compliance evidence at runtime. Every agent action — from SVID request through policy evaluation to downstream tool access — is logged with full SPIFFE identity context: which agent, which action, which policy authorised it, which human identity was in the delegation chain, and the exact timestamp. This is not optional telemetry. It is how EU AI Act Article 12–13 traceability requirements, NIST 800-207 continuous verification obligations, and enterprise governance policies are operationally satisfied.
CVE-2025-32711 (EchoLeak) exposed Microsoft 365 Copilot to zero-click data exfiltration through pure text embedded in ordinary business documents. The payload required no code execution — Copilot processed malicious prompt injections when users opened seemingly innocent files. The audit layer exists to detect precisely this class of attack: anomalous agent behaviour that deviates from baseline, unexpected data access patterns, and tool call sequences that indicate prompt injection or agent hijacking before damage propagates.
Risk analytics dashboards aggregate SPIFFE-attributed telemetry to produce actionable signals. Circuit breakers automatically halt operations when thresholds are crossed. Compliance export pipelines produce audit reports that satisfy regulatory requirements without manual assembly.
Named Agents, Assigned Identities
In a governed agentic architecture, every agent has a registered identity, a defined scope, and a traceable owner. These four example agents illustrate the SPIFFE naming convention and the permission model in practice.
“An agent should never possess a credential at rest. SPIFFE is becoming the TCP/IP of agent identity — it assigns a cryptographically verifiable ID to every container. When the agent dies, the identity dies. If you are communicating over plain HTTP with API keys, you are building a legacy system.”
Optimum Partners — AI Security Architecture: Implementing WIF and SPIFFE, January 2026Attack Vectors and Architectural Controls
Each threat reflects a documented incident or vulnerability class from 2025–2026 agentic AI deployments. Each control maps to a specific architecture layer.
| Threat | Attack Vector | Architectural Control | Layer |
|---|---|---|---|
| Static credential theft | Hardcoded API key in config — valid for years after exposure | SPIFFE SVID replaces keys. Short-lived X.509, auto-rotated. No credential at rest. | Layer 1 |
| Prompt injection via document | Malicious instruction in file processed by agent (EchoLeak CVE-2025-32711) | PEP validates every action against policy regardless of instruction source. Risk analytics detects anomalous patterns. | Layer 2+4 |
| Lateral movement via agent hop | Token trusted across hops without re-validation (transaction boundary problem) | OAuth 2.0 token exchange. Each hop receives a scoped, short-lived token. No hop inherits the full permissions of the previous. | Layer 2 |
| Agent identity spoofing | Malicious process claims to be a trusted agent workload | SPIRE kernel-level attestation (SO_PEERCRED). Binary hash verification. Identity tied to runtime state — not self-reported. | Layer 1 |
| Overprivileged agent accumulation | Agents accumulate standing access with no lifecycle management | SVID expiry forces periodic re-attestation. JIT access: zero permissions in sleep state. Policy-as-code enforces least privilege. | Layer 3 |
| Zombie credential exploitation | Abandoned agent token reactivated after decommissioning | SPIRE SVID revocation is immediate. Governance control plane enforces decommission flow with full audit trail. | Layer 3 |
| AI-orchestrated attack chain | Jailbroken agent executes 80–90% of attack chain autonomously (2025 documented incident) | Per-action PEP enforcement. Circuit breakers halt anomalous activity. Kill switch revokes SVID fleet-wide within seconds. | Layer 2+4 |
Identity Is the New Perimeter. Build It First.
The source IP stopped being a reliable security boundary when enterprises moved to containers. The network perimeter stopped being meaningful when agents began making cross-domain, cross-cloud, real-time API calls at machine speed. In 2026, identity is the perimeter — and for AI agents, that means cryptographic workload identity, not service account passwords or hardcoded API keys.
The threats are concrete. CVE-2025-32711 EchoLeak demonstrated zero-click data exfiltration from enterprise AI through ordinary business documents. The Internet Archive breach proved a 2-year-old hardcoded token remains a live vulnerability until explicitly revoked. The first documented AI-orchestrated cyber-espionage campaign demonstrated that over-privileged agent credentials enable full kill chains — reconnaissance, exploitation, credential theft, and exfiltration — with minimal human direction.
The architecture documented here — SPIFFE IDs for every agent workload, SPIRE for attestation and issuance, mTLS for transport, Policy Enforcement Points for authorisation, token exchange for multi-hop safety, and comprehensive audit telemetry — is not aspirational. It is the operational implementation that teams at Netflix, Uber, Google, Red Hat, and Cisco have converged on for production AI systems in 2026. All components are CNCF-graduated or standard protocol. The hard part is organisational discipline: implementing it consistently across every agent from the first deployed to the hundredth.
// WHO: SPIFFE ID — spiffe://workload.identity/ns/ai-ops/sa/agent-name
// WHAT: Zero Trust Policy — policy-as-code, version-controlled, least-privilege enforced
// WHEN: Real-Time Attestation — short-lived SVID, kernel-verified, auto-rotated hourly
// HOW: mTLS + PEP + token exchange + audit log — every hop, every action, every agent
// NEVER: static API keys · long-lived tokens · unattempted credentials at rest