AI Reports · Amazon · 2026-10-20 · Blog / commentary
Securing AI agent identity with X.509 PKI on AWS
When AI agents access databases, APIs, and sensitive business operations, establishing cryptographic identity through X.509 PKI becomes critical, and MCP itself has no built-in authentication standard. This post presents a reference architecture combining Keyfactor EJBCA with AWS services, using signed request envelopes, user-signed delegation assertions, RFC 8693 audience-scoped tokens, and real-time OCSP revocation. These four mechanisms prove which agent made a request, prevent forgery between agents, and confirm that each agent acts only on behalf of an authorized user.