Do Agents Need A Cryptographic Identity?
As AI agents become more autonomous and deeply embedded in modern systems, they’re no longer just tools—they’re active participants. They access data, trigger workflows, and interact across platforms with minimal human intervention. Yet despite this growing responsibility, most AI agents still rely on outdated authentication methods never designed for non-human actors.
This mismatch is becoming a serious security and governance problem.
The Identity Gap
Today, many AI agents authenticate using hardcoded API keys or long-lived credentials. These approaches are fragile: secrets get leaked, permissions sprawl out of control, and there’s often no clear way to trace actions back to a specific agent—or its owner. As the number of agents scales, so does the risk.
Traditional identity systems assume relatively static users and predictable access patterns. AI agents break both assumptions. They operate continuously, move across environments, and can generate thousands of interactions in minutes. In some cases, they may even expose their own credentials through logs or outputs.
A Better Model: Identity-First AI
To secure this new class of actors, AI agents need something fundamentally different: a verifiable, dynamic digital identity.
Instead of relying on shared secrets, agents should authenticate using cryptographic methods—proving who they are without exposing sensitive credentials. Access should be granted through short-lived, just-in-time tokens that expire quickly, reducing the blast radius of any compromise.
This approach aligns with zero-trust principles: never assume trust, always verify identity.
Centralizing Trust
A key part of this model is a centralized identity provider (IdP) that manages authentication and authorization for all agents. This creates a single control plane where policies can be enforced consistently, regardless of where the agent operates.
With this structure in place, organizations gain something they’ve long lacked: true visibility and accountability. Every action taken by an agent can be tied back to a unique identity—and, ultimately, to the human or system that deployed it.
Why It Matters Now
As AI adoption accelerates, the number of non-human identities is set to explode. Without a robust identity framework, organizations risk building powerful systems on top of weak security foundations.
These topics are covered in more detail in an analyst comment written for AKeyless.
About the Author
Simon Moffatt has over 25 years experience in IAM, cyber and identity security. He is founder of The Cyber Hut – a specialist research and advisory firm based out of the UK. He is author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker and a strategic advisor to entities in the public and private sectors.