AWS and Keyfactor Propose X.509 PKI Architecture for Multi-Agent AI Identity: One Revocation Terminates All Downstream Agent Authority

When AI agents access databases, APIs, and sensitive business operations through the Model Context Protocol (MCP), a fundamental question arises: how to prove which agent made a request, prevent forgery between agents, and confirm that each agent acts only on behalf of an authorized user. MCP has no built-in authentication standard and is transport-agnostic by design. Without proper identity mechanisms, any component could impersonate an agent, replay intercepted credentials, or invoke tools without authorization.

The AWS and Keyfactor engineering teams jointly published a reference architecture that addresses this gap through four complementary security mechanisms. First, signed request envelopes provide cryptographic proof-of-possession on every agent call. Second, user-signed delegation assertions authorize agents without sharing credentials. Third, RFC 8693 audience-scoped tokens limit the scope of exposure from any single token disclosure to one service boundary. Fourth, real-time OCSP revocation checking propagates credential changes immediately across all agents.

The revocation cascade is the architecture's key security property. When a user logs out, the system first revokes the user certificate in EJBCA. Because delegation verification checks the user's certificate through OCSP in real time, this step immediately invalidates all outstanding delegations. The system then revokes all three agent certificates, invalidating every signed envelope, deletes all secrets from AWS Secrets Manager with no recovery window, and terminates the Keycloak session. The critical insight is that revoking a single user certificate at the PKI layer promptly revokes all downstream agent authority without needing to individually revoke tokens, delete sessions, or contact each agent. OCSP provides the propagation mechanism, and because every request checks OCSP, the effect is immediate.