AWS and Keyfactor detail X.509 PKI architecture for securing AI agents

Four security mechanisms are layered: signed request envelopes that prove proof‑of‑possession, user‑signed delegation assertions that authorize agents without sharing credentials, RFC 8693 audience‑scoped tokens that limit token exposure, and real‑time OCSP revocation checks. Certificates are issued with RSA 2048+ keys, a 7‑day validity period, and a nonce of 128‑bit hex that must be unique within a 60‑second freshness window. Revoking a single user certificate instantly invalidates all downstream agent credentials via OCSP. The article provides complete source code on GitHub and notes that Keyfactor serves more than 1,500 enterprise customers across finance, healthcare, manufacturing, and government.